der: 14672:14675 got transaction with invalid offsets size, 2
[  350.268506] binder: 14672:14675 transaction failed 29201/-22, size 120-2 line 3338
[  350.268776] binder: undelivered TRANSACTION_ERROR: 29201
[  350.312064] binder: release 14678:14681 transaction 1140 out, still active
[  350.312068] binder: undelivered TRANSACTION_COMPLETE
03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x1)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$IOC_PR_REGISTER(r3, 0x401870c8, &(0x7f0000000280)={0xfff, 0x8})
getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f00000001c0)={'filter\x00', 0x0, 0x4, 0x1000, [], 0x3, &(0x7f0000000140)=[{}, {}, {}], &(0x7f00000003c0)=""/4096}, &(0x7f0000000240)=0x78)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = fcntl$dupfd(r6, 0x0, r6)
ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x100, 0x0, 0x0, 0x2}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x800, @rand_addr="00000000001000"}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@ipv4={[], [], @remote}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8)
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
fchown(0xffffffffffffffff, r6, r9)
r10 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r10)
r11 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, r10)
keyctl$link(0x8, 0x0, r11)
r12 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r12, 0x0, 0x0)
tkill(r12, 0x1e)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, &(0x7f00000002c0))
wait4(0x0, 0x0, 0x0, 0x0)

03:15:51 executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x89)
ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000000)=""/113)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r1, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r3 = syz_genetlink_get_family_id$tipc(0x0)
sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x4)
lsetxattr$trusted_overlay_opaque(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x0)
r4 = eventfd2(0x1, 0x0)
ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f00000005c0)={0x0, 0x0, 0x5, 0x0, [], [{0x3, 0x2, 0xfffffffffffffffb, 0x7, 0x4, 0x9}, {0x9, 0x101, 0xe5c, 0xd6, 0x7, 0x1f}], [[], [], [], [], []]})

[  350.322107] binder: send failed reply for transaction 1140, target dead
[  350.332240] binder: BINDER_SET_CONTEXT_MGR already set
[  350.332249] binder: 14683:14687 ioctl 40046207 0 returned -16
[  350.333391] binder: 14683:14687 got transaction with invalid offsets size, 2
[  350.333413] binder: 14683:14687 transaction failed 29201/-22, size 120-2 line 3338
[  350.333674] binder: undelivered TRANSACTION_ERROR: 29201
[  350.481840] binder: 14656:14659 transaction failed 29189/-3, size 120-24 line 3284
[  350.491139] binder: undelivered TRANSACTION_ERROR: 29189
03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  350.512159] binder: BINDER_SET_CONTEXT_MGR already set
[  350.518496] binder: 14696:14698 ioctl 40046207 0 returned -16
[  350.535747] binder: release 14696:14698 transaction 1142 out, still active
03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000140)={0x0, 0x1, 0x6, @dev={[], 0x28}}, 0x10)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000010000000000000000000002000000000000937d0000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000330000000000000001000000000000000000000000000000852a7470000000000000000000000000800200000000000000000000000000000000000000000000852a7470000100000000000000000000d10300"/120], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  350.559268] binder: undelivered TRANSACTION_COMPLETE
[  350.564892] binder: release 14695:14704 transaction 1144 out, still active
[  350.576250] binder_alloc: 14702: binder_alloc_buf, no vma
03:15:51 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040), 0x20000000000003b5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = dup2(r6, r5)
ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200)
ioctl$TIOCSRS485(r7, 0x542f, &(0x7f0000000080)={0x1b2, 0x6, 0x6})
r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r9, 0x0, 0x0)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r9, 0x400454ce, r11)
sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000328bd7000fedbdf250900000008000500ff0700000800060205a5db7e3f325d107a3c8aa203b23b00000004000200aaba56c5e0ed6045ee1256ca6350920cce7ab2e848f18d1347ee757d83aaf2dc978122c562dbf6fff8dd78629c957ac2f3b9ac1d17999712207d66618c0f83ae41ec104e74bce0fdd11da19c920babcd4f71e7edcc877baf066e28373ad95a8a20f1d917370e44105c7c05bf6c144e3f19d9b85c16bef32ace579e"], 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x81)
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="010026bd7000fcdbdf250b0000000800050004000000c039b2b1fe4e139c59b91bb9aa6ec003d139888b4e66850371d5be8472ee7a49e73b15e7243603591e71cbcae0f7d3a83f39434b76f767feddc71a56efa6d5ec6ce6b27aaa6181dc51a01cf84efce4693d935f161a548c3731579bebbdd0b83d2570e82a1eef7f09ea9869f1707244eb5d8c46c8164bb224ee1073fa37ed712f9a94dd8d74f26f9cb764d8252a0fc8d92fc9a71fda9f5395feb1943ca9ccdba5269f8b007719517b899cb92e82a3002fdf468f124f6f7141bd90ccbf229d1c98f7b1507322eb265b2bdd111a26"], 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x40)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r12 = gettid()
setsockopt$inet6_int(r0, 0x29, 0x18, 0x0, 0x95f172d77a4a5b18)
r13 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r14 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r14, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r15 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r14, r15)
r16 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r16, 0x4024700a, 0x0)
preadv(r16, &(0x7f0000019c80)=[{&(0x7f0000000700)=""/141, 0x8d}, {&(0x7f00000007c0)=""/51, 0x33}, {&(0x7f0000019bc0)=""/180, 0xb4}, {&(0x7f0000000bc0)=""/102400, 0x1937f}, {&(0x7f0000000900)=""/16, 0x10}, {&(0x7f0000000940)=""/70, 0x46}, {&(0x7f0000000b80)=""/15, 0x11}, {&(0x7f0000000a00)=""/210, 0xd2}], 0x8, 0x4fe)
ppoll(&(0x7f0000000240)=[{r13}, {r15, 0x2}, {r16, 0x84d}, {r2, 0x200}, {r0, 0x8}, {r1, 0x80}], 0x6, &(0x7f00000002c0)={0x0, 0x989680}, &(0x7f0000000300)={0x1}, 0x8)
ptrace$setopts(0x4206, r12, 0x0, 0x0)
tkill(r12, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 3:
r0 = open(&(0x7f0000000040)='./file0\x00', 0x400080, 0x40)
ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000080)={0x8057})
socket$inet6(0xa, 0x3, 0x87)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r1, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
poll(&(0x7f0000000000)=[{r1, 0x4000}], 0x1, 0x3)

03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

[  350.603111] binder: undelivered TRANSACTION_COMPLETE
[  350.603162] binder: send failed reply for transaction 1144, target dead
[  350.605571] binder_alloc: 14710: binder_alloc_buf, no vma
[  350.605587] binder: 14710:14717 transaction failed 29189/-3, size 120-24 line 3284
[  350.605888] binder: undelivered TRANSACTION_ERROR: 29189
[  350.621704] binder: release 14713:14718 transaction 1150 out, still active
[  350.621707] binder: undelivered TRANSACTION_COMPLETE
[  350.625084] binder: send failed reply for transaction 1150, target dead
[  350.632164] binder: BINDER_SET_CONTEXT_MGR already set
[  350.632172] binder: 14716:14720 ioctl 40046207 0 returned -16
[  350.634350] binder: 14716:14720 ioctl c018620c 20000100 returned -1
[  350.634447] binder_alloc: 13628: binder_alloc_buf size 140269336920064 failed, no address space
[  350.634453] binder_alloc: allocated: 160 (num: 3 largest: 144), free: 12128 (num: 1 largest: 12128)
[  350.634470] binder: 14716:14720 transaction failed 29201/-28, size 2199023255552-138070313664512 line 3284
[  350.634645] binder: undelivered TRANSACTION_ERROR: 29201
[  350.682459] binder: release 14725:14729 transaction 1153 out, still active
03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200, 0x20)
fchmodat(r2, &(0x7f0000000140)='./file0\x00', 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:15:51 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x84d6e8c083b63664, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0x2, 0x0, 0xb6)
io_setup(0x2, &(0x7f0000000000))
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:15:51 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0x1ec}], 0x2)

[  350.682463] binder: undelivered TRANSACTION_COMPLETE
[  350.683456] binder_alloc: 14723: binder_alloc_buf, no vma
[  350.683475] binder: 14723:14728 transaction failed 29189/-3, size 120-24 line 3284
[  350.683731] binder: undelivered TRANSACTION_ERROR: 29189
[  350.693802] binder: send failed reply for transaction 1153, target dead
[  350.785482] binder: 14702:14709 transaction failed 29189/-3, size 120-24 line 3284
[  350.794682] binder: undelivered TRANSACTION_ERROR: 29189
03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/member\x00', 0x2, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xa0, 0x0, &(0x7f00000003c0)=[@acquire={0x40046305, 0x1}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x1ce, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_handle={0x77682a85, 0x1000, 0x1}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@fda={0x66646185, 0x2, 0x0, 0x29}, @fda={0x66646185, 0xa, 0x1, 0x3}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f00000002c0)={0x0, 0x20, 0x40}}}, @request_death={0x400c630e, 0x1}], 0xd3, 0x0, &(0x7f0000000480)="5a13aeeae6f112622b4d28ddc62f20a463f94000caf24dde402932318aa8dd2d7ab1f18e2974819396f9290806ee5a09dfa1f4aaa2464dcebe2ec54be144e4d59c160e8a9571e52f263dc40a2192e4725ad8363589ff7116d0e234b6cc780df20ef665aebbf262ca64ea76a269a689adf45afd44cf526868ce1886e83f908d23d6cd02af26c8b987413314272f4afec5d407544586e2aa4e5ac7881545f5f55616da5a5521edc38f1d1aa4d533d111dcb85363ea612487e2f2790e5cc0e3a89bfd28c0c15b40cc46938c6ea37a28050d78f791"})
r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = fcntl$dupfd(r7, 0x0, r7)
ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880), 0x0)

[  350.823309] binder: release 14738:14743 transaction 1157 out, still active
[  350.826252] binder: BINDER_SET_CONTEXT_MGR already set
[  350.826259] binder: 14736:14741 ioctl 40046207 0 returned -16
[  350.827706] binder: 14736:14741 got transaction with invalid offsets size, 2
[  350.828062] binder: 14736:14741 transaction failed 29201/-22, size 120-2 line 3338
[  350.828612] binder_alloc: 14737: binder_alloc_buf, no vma
[  350.828626] binder: 14737:14742 transaction failed 29189/-3, size 120-24 line 3284
03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  350.873783] binder: undelivered TRANSACTION_COMPLETE
[  350.879313] binder: undelivered TRANSACTION_ERROR: 29189
[  350.885702] binder: undelivered TRANSACTION_ERROR: 29201
[  350.900794] binder: send failed reply for transaction 1157, target dead
03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)=<r3=>0x0)
syz_open_procfs(r3, &(0x7f0000000140)='net/ip_mr_cache\x00')

[  350.915405] binder: 14747:14750 transaction failed 29189/-22, size 120-24 line 3138
[  350.937561] binder: 14753:14760 transaction failed 29189/-22, size 120-24 line 3138
03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
ioctl$EXT4_IOC_MIGRATE(r0, 0x6609)

[  350.941902] binder: BINDER_SET_CONTEXT_MGR already set
[  350.941909] binder: 14754:14761 ioctl 40046207 0 returned -16
[  350.943031] binder: 14754:14761 got transaction with invalid offsets size, 2
[  350.943053] binder: 14754:14761 transaction failed 29201/-22, size 120-2 line 3338
[  350.979969] binder: 14758:14764 transaction failed 29189/-22, size 120-24 line 3138
[  351.020327] binder: 14765:14769 transaction failed 29189/-22, size 120-24 line 3138
[  351.021754] binder: BINDER_SET_CONTEXT_MGR already set
[  351.021764] binder: 14766:14770 ioctl 40046207 0 returned -16
[  351.024004] binder_alloc: 14755: binder_alloc_buf, no vma
[  351.024023] binder: 14766:14770 transaction failed 29189/-3, size 120-24 line 3284
[  351.048140] binder: 14774:14779 transaction failed 29189/-22, size 120-24 line 3138
[  351.049891] binder: BINDER_SET_CONTEXT_MGR already set
[  351.049898] binder: 14776:14778 ioctl 40046207 0 returned -16
[  351.149863] binder: undelivered TRANSACTION_ERROR: 29189
03:15:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x2db020, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getpid()
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r1 = getpid()
fcntl$lock(r0, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r1})
r2 = syz_open_procfs(r1, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r2, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0xffffffffffffff72, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}, @ptr={0x70742a85, 0x8000, 0x0, 0x0, 0xfffffffffffffffc}, @ptr={0x70742a85, 0x100, 0x0}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  351.155387] binder: undelivered TRANSACTION_ERROR: 29189
[  351.160919] binder: undelivered TRANSACTION_ERROR: 29189
[  351.166503] binder: undelivered TRANSACTION_ERROR: 29189
[  351.172167] binder: release 14755:14759 transaction 1165 out, still active
[  351.179726] binder: undelivered TRANSACTION_COMPLETE
[  351.185085] binder: send failed reply for transaction 1165, target dead
[  351.193019] binder: undelivered TRANSACTION_ERROR: 29201
03:15:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=<r1=>0x0)
getpgrp(r1)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = fcntl$dupfd(r3, 0x0, r3)
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
listen(r5, 0x200)
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
bind$netlink(r7, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x2}, 0xc)
fcntl$setlease(r5, 0x400, 0x3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="11634e6c7e3b00000000000000000000000000000000000000000000000000000000000078000000000000000200000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="852a747000000000000000000000000033000000000000000142d225c06da90033e24abb000000000000000000000000000000852a7470000000000000000000000000800200000000000000000000000000000000000000000000852a7470000100000000000000000006d10300"/131], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0073e76f88020000000000000056697f00000000aacc004c7fbea3bc0eb77e162cbdcdec1077c939d11af6fe192e89b0afeaab0e2b2114268cbfc7fd496691d0ad6c22838e26d02581d79d654260e338ac"], 0x0, 0x0, 0x0})

03:15:51 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0101000000000000000001000000440001000c00070000000000000000000c0006006c6203000000000008000b0073694e0008000800000000000800090000000000080001000a000000080005000000000071874877a768421bdbe53322189e47be2f0423c3b507d4e36b377eaa1e145741105bc34cf023973f98e680f91a5a232c7faad6987d052c3f06362caeb47391eecaeaab67b872dede586415db843014b493f16858163f00b7a5ab7af048ea8caa586ad1bf078300801ee60379345937ef4fd961d49309c43bc8682a77916734e024abb80fc51f73348c476dd55b31909521992627af39da5cd565ba0f3a70c60adaa81527c1a235ebea3f49994c1b712b2b6501340d2601dcfd5551d0843eeb796fa385bc98bca7dda6034f8eda0b25ccee111f5960"], 0x58}}, 0x0)

03:15:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  351.205153] binder: undelivered TRANSACTION_ERROR: 29189
[  351.214712] binder: BINDER_SET_CONTEXT_MGR already set
[  351.214720] binder: 14788:14792 ioctl 40046207 0 returned -16
03:15:51 executing program 3:
socketpair(0x2, 0x72dc8d1145f9f474, 0x20, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/policy\x00', 0x0, 0x0)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000280)={<r2=>0x0, @multicast1, @local}, &(0x7f0000000480)=0xc)
ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000005c0)={@local, 0x7b, r2})
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00')
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="2000000003e97839930ebff23eb7072e5b72af3c3bab449cc724a8562bbf32dd404be7aef5b7de1157dac4233705", @ANYRES16=r3, @ANYBLOB="300c27bd7000fbdbdf25010000000c0005000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x200a0000}, 0x8002)
r4 = socket$inet6(0xa, 0x3, 0x87)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
r7 = socket$inet6(0xa, 0x5, 0x3)
bind$inet6(r7, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
setsockopt$inet6_tcp_buf(r7, 0x6, 0x0, &(0x7f0000000400)="2c09cfa4bfcf3ee8ab6371971f727e6b1d2a3593c89b8cae04c3b2d72c00eb43c1cfa95f936f896911974c9516997aabad967bc78e4de53ef2e8deb8ff6b3c812112ce7c7f36d057c6d3fd7989", 0x4d)
ioctl$LOOP_CHANGE_FD(r5, 0x4c06, 0xffffffffffffffff)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r8)
r9 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r9, 0x4024700a, 0x0)
preadv(r9, &(0x7f00000017c0), 0x1fe, 0x500)
connect$inet6(r9, &(0x7f00000000c0)={0xa, 0x4e21, 0x9, @remote, 0x400}, 0x1c)
setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000180)={'mangle\x00', 0x2bb, [{}, {}, {}]}, 0x58)
r10 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r10, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
dup(r9)

03:15:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  351.215807] binder: 14784:14789 not enough space to store 0 fds in buffer
[  351.215834] binder: 14784:14789 transaction failed 29201/-22, size 120-24 line 3475
[  351.216781] binder_alloc: 13628: binder_alloc_buf size -16 failed, no address space
03:15:52 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240))
r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r8 = getpid()
fcntl$lock(r7, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r8})
ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=<r9=>0x0)
fstat(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0})
r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r12 = getpid()
fcntl$lock(r11, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r12})
r13 = getpgrp(r12)
stat(&(0x7f0000001cc0)='./file0\x00', &(0x7f0000002580)={0x0, 0x0, 0x0, 0x0, <r14=>0x0})
r15 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r15, 0x0, 0x0)
r16 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r16, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r17=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r15, 0x400454ce, r17)
r18 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r19 = getpid()
fcntl$lock(r18, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r19})
r20 = geteuid()
r21 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r21, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r22=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r21}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r22}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r22)
chown(&(0x7f0000000000)='./file0\x00', r20, r22)
stat(&(0x7f0000001d80)='./file0\x00', &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x0, 0x0, <r23=>0x0})
r24 = getpid()
r25 = geteuid()
r26 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r26, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r27=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r26}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r27}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r27)
chown(&(0x7f0000000000)='./file0\x00', r25, r27)
r28 = bpf$MAP_CREATE(0x0, &(0x7f0000001e40)={0x9, 0x10001, 0x1, 0x5, 0x702, 0xffffffffffffffff, 0x1, [], 0x0, 0xffffffffffffffff, 0x1}, 0x3c)
r29 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r29, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r30 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r29, r30)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001e80)=<r31=>0x0)
r32 = getuid()
stat(&(0x7f0000001ec0)='./file0\x00', &(0x7f0000001f00)={0x0, 0x0, 0x0, 0x0, 0x0, <r33=>0x0})
r34 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r35 = getpid()
fcntl$lock(r34, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r35})
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002240)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r36=>0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000002340)=0xe8)
r37 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r37, 0x0, 0x0)
r38 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r38, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r39=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r37, 0x400454ce, r39)
r40 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r41 = getpid()
fcntl$lock(r40, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r41})
listen(r40, 0x200)
r42 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r43 = getpid()
fcntl$lock(r42, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r43})
listen(r42, 0x200)
r44 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r44, 0x0, 0x0)
r45 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r45, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r46=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r44, 0x400454ce, r46)
r47 = epoll_create1(0x100000)
sendmmsg$unix(r4, &(0x7f0000002400)=[{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000100)=[{&(0x7f00000002c0)="48fbea0ef0ff63d961c4bcf7f10abdf89011098732a4efe78f205e825877b77c284c735e6a6da36a9a4be4e77786d59f10639e889ceb75988282e7b97bd1ad87f29f664bc9e76d5a20d8a53410c0f99c01f3700a071502a80a1cfba3bce6715952b638327fd888067209b6d0488a5706874f1c264502e7578be66eb6b9c0a74f5af7bb840f0089ca0f6bb3aa69cb36c9f3c83b52c2a6e43c6432e870705777ebf0460976cb0388632aff9401ebbce515ba3240471f0ea73bff41388704c10af825fed0004d0b51baaba9511e607aac9a82e3f21255babc6ce61e211bead869", 0xdf}, {&(0x7f00000003c0)="8d868b6ff871b5709572d70919d8838870e619f2630c9aff35ac922eadce6573f07b7857c9dbaeb1d755055d5638ffd67ddac05eb658b7e853f9356f536cbcd74ee167c1905f4bf971b2489d818f40e9020b2aadb2e555654a4c2525adebd9bf71646f1da603a357e34f0fd3c35a1889cfa74370b23557002aa16b9e7bdfce35afab150989b26dc1b2370767782133ac58ac493d3fa46bae753ae3374801c920f8b24e8c471aec65c2ceaae1ecde2a8f901585c0f96418c390ec22a9cd6cf655fc4d6d6ff86c61382606e11977b4ee37f9f86b80613da5cb7a38c6588d0cdf387b211371c70bc01512775e83e1c24a47e81013fb734d4ca6", 0xf8}], 0x2, &(0x7f0000000240)=[@rights={{0x1c, 0x1, 0x1, [r5, r3, r6]}}, @cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}], 0x40, 0xe5540407c34c4910}, {&(0x7f00000004c0)=@abs={0x0, 0x0, 0x24e23}, 0x6e, &(0x7f0000001740)=[{&(0x7f0000000540)="20805c4a1b054889895d271ceef8c1b49d2758c5c49c9f93e783d30f9bc2ff3fef22d5119b84e04e8074f615f375a7922fca013b6ad23126a9ab8c7f48741c26a6bfec43581d", 0x46}, {&(0x7f00000005c0)="16b495a5859ba94d287d251ab762cbd3604359346bbeda07d49497eb31153724cb5be017d38dce02046a9d67f7e14db2", 0x30}, {&(0x7f0000000600)="3d28188905d53a44d8d902ab6227333b725cfbe7a3ed5e414aaff15e1e66a130f6be60764469159ae6bc9b97591c431bec4183a946dcbfecbc851d420e25a04390c18dabf39b07497f46556b9ea5465ddd389196acc669d55f53a77294168ce606b87ac1bf1416abbef7b628cffe8cee0de5f8e7ea3a99520e5fbfbdb1e138bb80018914af3b20cab720ec3f882f4a575f2035cf16c5811feafa269c9e464ef926ef2b0a1b14e0c87f0340def8ceac036992549711bc34f20703fe9d3495e5e99dc3c8ad8651857f2d75063f822f78fd77135b905bb2b4c0dbcd9b329ae4c265c6f3c15908a4e3c027be2f09530bf5230eab412d9dcdc870914b2c8d494fb80096d2095da0ae0b50eca63f3f5065214cd288071dd779309a9777d087213edabcac73bc6842404e14497f80ef494e5e05bac10ea576235fc95d6017a3da2a203f8157aaba41bfe364f39d717f51cc0d7c631b4067ce96f920f5d10272be789ad6eb64610997b0b5703858ed4af6fd883fead8754afb3697202fc9b5bc488b96a811b02b1be17e3941b03c66c0b87a3f7cefe611cb22ed7026c3ac59e4a7cc5917ccae03e7c969a4e594fc310ebd9f5b7f24e8e7d84fe1f233d4775be88cbf8faa4f37b19271dae2e9fa5cc611934b3ce701939c14acfe40b86c5e960aaf0f05abc3ec597b10b7fccfc523572490c201b05e87a75e81606aa75dc652168c271b90e60eeb304f72de64f47199ad014064ab763d643927a2e975231dcce8eadde56ac0eeaeadddc3bd89b86610019ed5d37f42481d0a91bf6569cbab4a53508ca89270799c167a0abb4bfb73973c6f350b38130f26acbfab5d4a5bd4eb232a38c44ba47ba5453d09dad1f9f77d6499f1b40c32e74b04f6f6f100202ab60bb1982e7ffe4b4fbab410d07dddcb600fd98ca683e9955a71f7a16bf5c7cd7e75e558becf3d7d9104662936ef6d1817f88aee2a374f5e45afad323f04393c6fc5254a8561379fa9a7ed668cb02b8aa02be618ad9c8f481f9ccc0b2df149ba1a77f3cc07bde98ba84c50ccc8f7d9599d1f3afa6664ccf8bb704092d7e7caebc0f56bdebc27a08a92c3736228eaaa9da44ae5382a84233ba5fded8465e567f30fce42e729026e3eeaeb8bad2217eb295c4e1763da5c7e1b7f0960918399575399abe6603b9a7203a225ae747f8c28fab49e5f45b0b73eb2a63ae3427b4c962701e18b2736a10a1c6cc75acbfc49f09b143b894b8496d3ab997cbf6ea47249ca7e9ea374ae617fef508d45450a3a7fa01a005a0f9de9410df0c5de14da2edef46f3a39facc28da934f9b31db065f92384ccf41f3d421ea7de55f9a60492bc16f8bd67124c4159bb067dc6063a3785c268765c3ad8a703aade9a4dd8486bc79e147e8b67dc0bf4dbb64011b064ddd2daf7ad2f23248f7a3fa56ca39c0f38ca3333d45eb93113312cfe085d9e5776be3fbf97d95c65de00f8862e2a56596fd620686300974e379bcd5ce17d8cf6d60422e05a2197ecf2b960b5297eacb668e7582340c5e1c0e9e48d89790c15d6148bdae78296de71199221a612485191cdd527a1041c57ad596c62ae3f6acc2a670be30d40322f0d3acde6f56936944411f66bd83ff196eb54584815976407df75cd95acb1d7476f3f0a99cf9e14daaaed6e5caf36a8c02a20d63de236ad0995fd6a27530de704432df37013f0f478e2561337d5b7607063e789d8fc32269753143223ed424c82631f7fde7b55dd35163c3a2133138fef22d89bb8a689eb5ae026488d9f021755d00a954a72c5ca386fb14aaab24602ab001867434ffbdf46faf61a5bb2bc83315ca6192577f8db819e9b0a853c11fc81b28957fb92f4f483115c18802326d49b71173c2dc719a2305c1b71a5ca6f86f203bb8b73e57a264b3c23fe712a16e06c581da960448d82298442b347da3e307290eb223b4ddd586ae04c77af7c5f57aeffff9d26c27d07a12a70e63cdfe16ea4bf242eac95be1408b5b2c49c30c9b62f3cb3361048bb908c3164eb07205b27daf1066f34cc2a856cd37d6d09a6853af3dbae1c0091807ad4be5f5fda357bc05a7e63dfca3c89ada44d715fd47b9e5c28c9c1223370c83900ee77b0ea1dd77997687b0e74d75faa3de8ce264bd138b489bdb6e96ac5046b28fdce058f714291b4185db3da4435e37a9e58e4df67b6654fed2ec035a949a1d3e9a71d130929cedf82b6612f934dff15b9145d72fb884cc538c6343695d0dd4cfee8ea2d0eae9ea09775f2e26dd8ca070e2ee66952e982bb717deb20e099063573f667325588d0218f994a9768a22bd990328272efb39aa65091e3a8696823a1cac66ce0127cf6a5d69bccea083ffa0e872ea3d69701795b977884d3d6145ada61ad0ae7ed06ab87091130bf8944c17690cd3fc289c73998f483280557047c273aa8a51e1db2ecd85d3800ba300c5c954bca426d2a679acd953c5ad523731de1b643ed38047d25377d121937dae4c00886ac0d6dabe51ee8c66314de12ec3a551b472ac5827a08eeaa93e4cb91721df11657e5689d6856e4e21bcdc7cb38bec5c0b190ca86d836c9376707cc77dfd0f4f81bdafa5555ac21ef0294ec7570831541f34590967b676fadc48edab0713bbd633776892f16046eab3cb075b8281139c858c9a8bf658492d3d8c12b2cbfdff13b9e4229fee8ba3cc798bec2904423ba74aac7be84dc354d3fa89d76ad5deb44fde3468016e71867cd02c983f3ba704619f8d46e361df38d0722ec6a5e0c5f870e601e350ecd62f3a4a281854d0b6e45b954151a00ca49da8416ce75e2af6f6c63a258116d7551ecd7ea6ec33737bd771631f7124e991c59e1b3e8f083477bd3948ad02df1ca9c61eab32251f37b61017d61b33db8c3c00fff35a7d0f898590dc28840c15abd7dd49cc694864c0c56dc5076322ad45dc2d558b1d60a4178ecfc4720861c58e2f0f08a59aa7884a0e0bf7cb8f5f8c1deed04aced776c4c2fae6be3783f16d94af52526872f43ef2b9a297b78b6f7dbc0da2ccc5f0704ab9b92af92ad28315f14a571c1941e6a74ce93b9a848a14b43bdb84ce338b842108f59ecced21db346c1a16e0363df23578aaaea3de810553ea587afedbfe5276cbdb17e74f0622757b8c9750af243cd035431d37d65a273bddeeee28cef49fa2768e50e884bd6f4cd9b709a7c77cf27de16513a22c0926a9e542b388894c47703314634a5ba088e23c7e4b3c27687cf04ee11ed70af72bd349d5195832b62ab96b4e201debd344cf4f25cb493174b0ed574cf83b667a65e844785cb1cad80d49298919296a2e35c927f1b5811a396f97d6f5a933034589a898e1a7e12a391755d44b9676b8a1691dde0b7b377c1cb9a587684b9a30e4db180d239afb91b52b0c5fd2cb08160d1445022b5bc389a26d24d5a6163612367bf1995eddce8c960864a45b39bd58332f6a0ffef974f78253db293a4abe01462b42ebe314f22824e9f9483380e11a4614f6b331422ec9e25ad5f8de789c73e99118cec5bad5dcc2d608cd3556d61cf9f915c780bb68b3bb1da4e5b1359b94ffa5bd0f2e8a04309ee7c85c96b4f1d7940a941a6cbe83b4228c8217387503d7a183eac2754fbd6aed0d5db5465105d9ee4718a9790f64804a0bfb704fa9b65e3c735073ecce0db619d3dbe44d123360e7903d3e6346db58b70b80c401fa7c48dc531e5aec90d0bfa941a30f942ff2e10625a6515e0052134f584e0ce5636d91eb7df55ade0a6e91fa2b432a1844741e3dfa87f0eb6d6665d91aecd1cc97d36b39bb5a212f80e7e0e94684b2a56a883f73fc0921a9678368331e5372b053044db7c04d58e049c74c6e4615d60ff88142f2b3bff13d357d651d63dbb3ebcb376d89c3d00356fd081f3a2d138f23d7a36ef7ff836325e1d317c36923f109d0db6031ae35f04b4feff338dc2699847e22bd6f3412d7260fc14223d45f720a399273dce8f4ec956a99820699575e2f1fc50afa17ff775ac5fee2a6be43a1d27e285f0129250798a2de5820ed818ac1372e73ce894d087d94958aa897b440f8f03f3c8791767ff1ebd0279f273f95284c551dd1be8f9da628b7393c9990852d6b3ae90dd96e7b6bb632093e09c39d2d024e40d6bbcc1b26283ce342e8828f2354abee84263e004c9c373e72224476ebf50201a102e24cd6b09a204f801d7a5cd86dcec81b94eac88a91bc8089f39e08270ba5b7d59f58d317c5e40513ce7d22a928651e0bc1e38b39c7339029c2ad7ff3e24582cfc6fc5f1986aa8c5e03b9a559ead9e9e999e140f36d6a1f270e7f2bc7290f909bbd34eac0477147140560e3427f69e8b21ff6ec1937e62b1c1c93f3ec54d987d39b252fc3347cdcdc9136d6cb93af9c13e5c5312fa1c0b9ae8b79f8a89a215917f1a6c300569976c4d333bf5ccc2e198b987c9381c5347171f34af5eac8d3471babe23d759ff3b3213f770b2b24f7a1bc8105ec6393a5469a4fd6d7334528312582e88bcf377d143a791347e3608bb4272eb9ea33de55b61dccd0a156b4927fc164a14628f4ee4af3e74570683ede54c05dcfdca7704462f38fb2aa4eba74f36e6df3eb1b9de014cf96d80175b9f723ad307e6342a8c00f483ee7c296c8665fa5fbac50f29fa14d7dfb8f45535f1b00dcf1f57c46f96ff11111a8242e985ed6f30a4248c35ca1887399bfd23014e1cfddf39d7db20cb5b85cea14586584721ca8a35d2c697e554907d0075f2b59de9c58d7f22338e26ea9f06bb40e793a8baf1f760ba60546652adca0954ad309cccf8e073cf6b2f48e759c5e57b2e2193b622b62bf8b54c3e808d1e4fe84885da4bb3c08404dd7f7a68c0b806e97d0351e0fa033dbcaeb4539638a3b2155ff934652562d1b8a6928576b96c43b4b75572e14022fac4e7fbd87ec6b5ec4c1e1933b24f541568d164f941589880f92c685109ce45d04f894e0addef278bd1de438c74d62ead8aa1e24dbead86cc3da50b68fb3efc856a69f25eba892d8613b6d844c8c9ea54849883111c491f3e6854755001ee328c8a6176749ef0f8b6d8192fc61796bddd2ccda80dc2b7c11a2e6ded5cbb66f35c7b4439612c987da0cbe81caa37dde8b2f97f39c0f7e0bb550fb4170dbad6254360ba9e26fccacaa100ef85324744801b7fe146f668c385bcc5c73e299678dc2f2fd3d243ba27afd4199314b01ed82224fd8c33bef052465d7ead861e478576237038153d4821e41573a2b80d132f465650b6cacffe8ef0333caf021ec5d43fcf01ce0029e1c3ec9849717a370baad7ec22d13b42ff8e0b553ae89b5db57cfd87ecb2d0a03b55501933bb6be26cc1eea4a678b3927472dc94ff0630d69edd04a75a7e19b391563ebb3a73bdc6ab6e2a9b38985f5db0875627ab8f000040ef140eb703e767b04abd7644ec326aac17cb2046f175bc93d7fc136bc3b06f0cfe75ec9ed69ba94acc1541317a0d6f978e6ed99095d03a55b076e9da286e82a48798bdc223694ea8c799bfba35a5d71b79e58d17c0519d480dd55ce3ea6562a177e8a4a7b5bb5f8d926f72efc7154b2775a2b3fa40af3dd988c8f56a71ea468aa91df4eb8561884f7d52cc40344b6fe3d4f49856fe6f0fdc5eed250d075b630f1a8ff0c6a52d1d6db89844d06d4bcf17a6580f2a3106e783b7a957c66b053059c1d6d0a17f1fbbc01dcdf39dc0c2e71175f0f2656c3d3960e36c3986470d4cdc7fff9b436adc59db1824f1e4f83aa5fc01bebd5decf3907d0da9f3628fe6af16ce68ef733470ce247673a235b4c2c24f94f47cd02c0d28c05", 0x1000}, {&(0x7f0000001600)="2bd3d4c28e1f80aa984fc43abcb63cdf1af4035352b9bf08e71245a46c19852f64cd2f89e8413c94382e49ac373369aa0a27d374c9edc1d4645347587c80602043f85b7c54e066ffe8e44f08e30c4bd6603b07d095f5515624fb38e174ebc8dd0cd23d0a21ad22e0833a", 0x6a}, {&(0x7f0000001680)="73994dd772c1214635c1774155659790ac262705741f64619185552f5255bdaa6ffee049249a2a78f360fe20dab95e0e3755e1c1e96d237e3d577d30c84c11f338bc2faeb2b24187be6c45cd52e000e066b4ca123df0a6c8799713a7aa9856b5508dfdc3", 0x64}, {&(0x7f0000001700)="c22c640521e2ac", 0x7}], 0x6, 0x0, 0x0, 0x4020000}, {&(0x7f00000017c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001c40)=[{&(0x7f0000001840)="e77705c2fcbae9ad1027", 0xa}, {&(0x7f0000001880)="ce12fa0dc388e10620f520e9faa0e1786ae836d2760c6885062d42275ef0239d2e67ea834c5b0857cc2c6a4038e66b92f4c6192e0a51219aae229b0b2be26609d93213dbce4c0354e4aee469a21cf907e4d61644ad8c88a5420812662bd7b8f4be3fc0df90e4a2c8ffdf7ee3cbb5f10e462b3e87df77c4d3103bd4c09c0a9ad112e3add63ff2102ba7c98163e5d703b963025a4827d69bff3d3d879f4fb1a9023ddb59d5d2928406655253159be57ea97cfc8723a5e49e828f634e521a5cd2670d249ce5d6d7d60d2ab70ec93c2ef512ff07", 0xd2}, {&(0x7f0000001980)="5d4487a15e737a1534afc238cf57f3b988371103bdeecb61eb6d23b0b018245aa9cfdc16c4e7a0d10b410cf5c0ac06a378e2a13696f5db813ee303f824d6cea3d2bea59f8566f5b7c19fda2da096fb6f288fb8a455b1ed871e0c0e720d37238a1d35a78ef52bd432a4ccf989280e251051b85bbe096ec82f2532add6dcf2e567d4d9bebe0f82b82c313b7ab27d25db7e6943c4845dfd15b97e9177fda6520584fcfd27f863adad", 0xa7}, {&(0x7f0000001a40)="2ea27f5a873317ab2e7d1b63a73565f75ca67737f52ebb72714cebc2dcdf3ab769b94be6aa510ae3e6d69d798f70e4a7fa5962d791b7467e4ce472249020bd92a08a0036a4e00a5837d067d51073619294de4f7a027c6783fd34302b2e2d9dc07a682f594f5552cc4368ea830da58d2710c059a91051c7c08df3c4a65ceee028c5a0e07865364de28c0bc4769ae159caad52c2138c0784df966b48d4e6814ab87b17a0ce6e2559234ca3636aa9fc7aee04e04e8343a9fcde45d2b3c621f52adb181627efa578d0b793dedbc19af8d18f75b5940f852ad34e73446b19954c23f800c0d1e9b66e49dafab4def97c580daaa562e8509ce7e7", 0xf7}, {&(0x7f0000001b40)="c7855b06dc1bc0dfe8299e618d54ca5462a4e594d846ecf5bcad65d854b2595019268f899b6fd18eb9520641320f561f305465f9d8429c3fcf909437d9b025efe804a46628d9663a1a416776590f7e2c6255ef4612cbd8ccc887161ca5dd6973a427721a0e33a5788c25b9f48d922bc6b69311053056237dc3778026f1520a80ef8ad2bf4e9065eb1a2f7ca3d6ce25df46da42416d8aa5c128041e4ad4d071ef5a1691f6b4c1d8d2eea8ea64de910a4e7a121014765db882113876cb6ae0c4aa16dd80ddac3c26d437413ccce10ee202c17e280c634d8bc82f4c494f48accd58c57c93a63ade8536619ab2fe0d74850a39", 0xf1}], 0x5, &(0x7f0000001f80)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0]}}, @cred={{0x1c, 0x1, 0x2, {r13, r14, r17}}}, @cred={{0x1c, 0x1, 0x2, {r19, r20, r23}}}, @cred={{0x1c, 0x1, 0x2, {r24, r25, 0xee00}}}, @rights={{0x20, 0x1, 0x1, [r3, r28, r2, r30]}}, @cred={{0x1c, 0x1, 0x2, {r31, r32, r33}}}], 0xc0, 0x20000080}, {&(0x7f0000002040)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000002200)=[{&(0x7f00000020c0)="f1997d9c933bc8cd1ae3f9308295347e3b758794ddfa04c3d905c87ce12f5b3e0f74", 0x22}, {&(0x7f0000002100)="995f4adce1b0a19f1b26a47e79ba683b6f5177fedd0b27087a50afe54f937e7a24e45d0e34d29eec95bf0ab6c612e36449283776f6a53a050ce491b61241fd357e9799e49e2b057f2fb7c08073a8c9c34c1c361deaa3630b05ac126f3b470229e8399ed176f5f2fef6add1ab35ad29bb62f74f022c15ab14e422e86c1ef3e3a98504a13c09764e31e671d9aab2ac50e5483ef0300e80b85bc02356f276ada060154e36d352b031d9df39439eaa283dc61bc854a7d5de0acd32b1d9bc85bfaab1984a27ec9f34b6d70fb632c0623d00370baeec4efae131", 0xd7}], 0x2, &(0x7f0000002380)=[@cred={{0x1c, 0x1, 0x2, {r35, r36, r39}}}, @rights={{0x24, 0x1, 0x1, [r40, r42, r2, r44, r47]}}], 0x48, 0x10}], 0x4, 0x0)
r48 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r48, 0x0, 0x0)
tkill(r48, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:15:52 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0)
syz_genetlink_get_family_id$ipvs(0x0)
sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0xffffffdf, 0x0}, 0x0)
mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$SEG6(&(0x7f0000000380)='SEG6\x00')
sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000080), 0xc, 0x0}, 0x0)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
faccessat(0xffffffffffffffff, 0x0, 0x0, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000000140)={0xa, 0x2}, 0x1c)
socket(0x0, 0x0, 0x0)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0)
inotify_init1(0x0)
alarm(0x0)
getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0)
setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, 0x0, 0x0)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0)
sendto$packet(r0, &(0x7f00000000c0), 0xfffffffffffffd4d, 0x1, 0x0, 0x44)

03:15:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

[  351.216787] binder_alloc: allocated: 160 (num: 3 largest: 144), free: 12128 (num: 1 largest: 12128)
[  351.216803] binder: 14788:14792 transaction failed 29201/-28, size 120--142 line 3284
[  351.236914] binder: 14785:14795 transaction failed 29189/-22, size 120-24 line 3138
03:15:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setxattr$security_capability(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f0000000280)=@v1={0x1000000, [{0x165, 0x800}]}, 0xc, 0x6)
r3 = fcntl$dupfd(r2, 0x0, r2)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r6 = syz_genetlink_get_family_id$tipc(0x0)
sendmsg$TIPC_CMD_GET_NETID(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r6, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xa0300428}, 0xc, &(0x7f0000000300)={&(0x7f00000000c0)={0x1c, r6, 0x8c052eb3830d84d0, 0x70bd2a, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x8000)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2c, &(0x7f0000000540)=""/119, &(0x7f00000005c0)=0x77)
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
ioctl$EXT4_IOC_GROUP_EXTEND(r8, 0x40086607, &(0x7f0000000000)=0x1)
lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f00000001c0)=@v1={0x1000000, [{0x2, 0xfffffffc}]}, 0xc, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000e1feffffffffffff01000000000000000300000000000000852a747001000000000000000000000000000000000000000000000000000000000000000000000085616466000000000a0000000000000002000000000000003b00000000000000"], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000d03f76f76400953046dd3d00000028000000007abe"], @ANYBLOB="0000000900925f5461cfdc000000ef75702a2e0b2cc05e26f37c632b227a6ebf076aabd647286ff3b0ebd8fb6e4da24d55d3b6ba8d5a813d1b9b4c74346618771dc18e141f3282984e0d715aa87a290daad41ccf654a0b2f144e7dea4e06bb1488b5b834ebef7fc75801a9d857a9a60000000000009862cf40866b650f040000000000000090e5925f6857c45840e7a4a7eec02f3cc599f28e3e7647bffe74a9d991f7ed79db9436f5b447f68bd99ba5f7b5173e6ae8e458a9de880f80e3bff6277443a8db904bcbd9e77781"], 0x0, 0x0, 0x0})

03:15:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

03:15:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

03:15:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000100)=0x1)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
r6 = fcntl$dupfd(r5, 0x0, r5)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  351.266855] binder: BINDER_SET_CONTEXT_MGR already set
[  351.266864] binder: 14799:14801 ioctl 40046207 0 returned -16
[  351.277169] binder: 14799:14801 unknown command 1817076497
03:15:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

03:15:52 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f00000002c0))
socket$nl_netfilter(0x10, 0x3, 0xc)
pipe(&(0x7f0000000040))
clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
pipe(&(0x7f0000000240))
sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="4034f6dad2bb2040212014a70f34"], 0xe}}, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x40)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]})
pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$PPPIOCDISCONN(r2, 0x7439)
ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r1})
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)
r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1cm\xccui\x13W=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x93\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\x839\xd1\xf0g\xe2!\f\\;q\xadLR\xd5 \xb0\xe8\x00\x00\x00\x00\x00\x00\x00\xc9\x00\x00\xeeLF\x96D\x04\x94X\xfa\x9ed\xc6@\xfcZc>\xaah\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002)\xb6{\x8a+1(\xb2\x1c\"o\x1a\x85\xea\x8c\x02\xfb\x94\xec\f\xd2\xf8\x02[p\xc31i\xa3\x8a\xd4M\xfa\xe6%\xe9}M\xc8\xf8\xba\xf7\x87R\xae\x7f\xdf\x01\x99\xbfU\xf8L,\xbb\xad\x1f\xf5A\x80\xed\xfa\xee\xb4w\xaf54\xaa^M\x80,\xba\xe2\xddjy\x06`\xb6\xb1\xa9\x13\xc9so\xea\x10\x1a\xc6@\xef\x1a+5]>\x17\xfa\xd0\x8c\xd68\x17\xe0\xee\v\xf2\x8e\xa7\x10\x97\xb75\xf3\xe7\x16?+\xe7\xafLd\x86\xbf\xf2\xbf\xb0L\xef\xf4x\x13\xd5\x06r\x8f\xc6v\xb2\xf9\xce\r\x92\xd6R\'\xf9\xa8\xf8\v\x15|\xefo\xd4\x80\xc0\xc2]=L\xc9\xfc\n\x7f\x92\x93t\xff0\x12\x10\xf0!q\xc5 \x10f\x11\xde:\xcc\x8e|\'+7\xf0<t\x1c[/\xc7\x14\xe4~\xc5\xdd\xbc4{U\x0e\f\x95\x1e\xcb7-9 \x1b\x1e\r\xe9\x1b\xf5\x00\x84\xd9uL\xce\x8b_\x91\x11\xa3\x92\x1c\xc64y\xf5\xc7iL\xe3\x85\x85\xe4\b\xc6\xbe')
socket$inet6(0xa, 0x3, 0x87)
readv(r5, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

[  351.277177] binder: 14799:14801 ioctl c0306201 20000180 returned -22
03:15:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

[  351.305465] binder: BINDER_SET_CONTEXT_MGR already set
[  351.305473] binder: 14797:14805 ioctl 40046207 0 returned -16
[  351.373324] binder: BINDER_SET_CONTEXT_MGR already set
[  351.373333] binder: 14816:14819 ioctl 40046207 0 returned -16
[  351.375764] binder: BINDER_SET_CONTEXT_MGR already set
[  351.375772] binder: 14815:14817 ioctl 40046207 0 returned -16
[  351.419042] binder: BINDER_SET_CONTEXT_MGR already set
[  351.419050] binder: 14825:14831 ioctl 40046207 0 returned -16
[  351.440771] binder: BINDER_SET_CONTEXT_MGR already set
[  351.440781] binder: 14829:14834 ioctl 40046207 0 returned -16
03:15:52 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair(0x0, 0x4, 0x22, &(0x7f0000000000))
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
wait4(r6, &(0x7f0000000040), 0x40000000, &(0x7f00000002c0))
ioctl$KDSETMODE(r3, 0x4b3a, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  351.441019] binder: 14829:14834 ioctl c0306201 0 returned -14
[  351.443158] binder: BINDER_SET_CONTEXT_MGR already set
[  351.443167] binder: 14833:14838 ioctl 40046207 0 returned -16
[  351.471209] binder_alloc: 13628: binder_alloc_buf size 6079738550822109328 failed, no address space
[  351.471216] binder_alloc: allocated: 160 (num: 3 largest: 144), free: 12128 (num: 1 largest: 12128)
[  351.471235] binder: 14833:14838 transaction failed 29201/-28, size 120-24 line 3284
[  351.476646] binder: BINDER_SET_CONTEXT_MGR already set
[  351.476654] binder: 14837:14843 ioctl 40046207 0 returned -16
[  351.478344] binder: 14837:14843 ioctl c0306201 0 returned -14
[  351.520989] binder: BINDER_SET_CONTEXT_MGR already set
[  351.520997] binder: 14845:14848 ioctl 40046207 0 returned -16
[  351.521338] binder: BINDER_SET_CONTEXT_MGR already set
[  351.521346] binder: 14850:14852 ioctl 40046207 0 returned -16
[  351.521786] binder: 14845:14848 ioctl c0306201 0 returned -14
[  351.526398] binder: 14850:14852 got transaction with invalid offsets size, 2
[  351.526420] binder: 14850:14852 transaction failed 29201/-22, size 120-2 line 3338
[  351.561651] binder: BINDER_SET_CONTEXT_MGR already set
[  351.561660] binder: 14851:14857 ioctl 40046207 0 returned -16
[  351.561953] binder: 14851:14857 ioctl c0306201 0 returned -14
[  351.580969] binder: BINDER_SET_CONTEXT_MGR already set
[  351.580977] binder: 14855:14863 ioctl 40046207 0 returned -16
[  351.581222] binder: 14855:14863 ioctl c0306201 0 returned -14
[  351.588421] binder: BINDER_SET_CONTEXT_MGR already set
[  351.588429] binder: 14861:14864 ioctl 40046207 0 returned -16
[  351.592924] binder: 14861:14864 unknown command 0
[  351.592932] binder: 14861:14864 ioctl c0306201 20000180 returned -22
[  351.810695] binder: undelivered TRANSACTION_ERROR: 29201
[  351.816607] binder: undelivered TRANSACTION_ERROR: 29201
[  351.823242] binder: undelivered TRANSACTION_ERROR: 29189
[  351.829175] binder: undelivered TRANSACTION_ERROR: 29201
[  351.834921] binder: undelivered TRANSACTION_ERROR: 29201
[  351.841032] binder: undelivered TRANSACTION_ERROR: 29189
03:15:52 executing program 2:
pipe(&(0x7f0000000280)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
writev(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1)
close(r2)
socket$netlink(0x10, 0x3, 0x4)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
splice(r0, 0x0, r2, 0x0, 0x80000001, 0x2)

03:15:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
mlockall(0x2)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)

03:15:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:53 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1163484000000000001f0000000000000000000000000000000000000000000000000000780000000000000002000000000000002c3a2966485a0552528067492e58d8ba0d5f23b1c175585f919161ae7b5033e80e365dbc4f6567000000002247089469f6736d7c5674117b6d773567ee918c1a936d0000252bbcafe4e673d0a91f0000002c4098627fc401b39b2680ddb3ae7ff329d209cfcab7a7ae9f7130834abacdb6a472f1ca4e2225d22ff4b65003fbb471f368e24760d7473f0abfe4d05a48ee30b2944ad544ab0a92869b461b86c4e62ef253df0ddf7f85b7a6cfee4696b9fc67d61e6f4cf28c20e7c7b17dd1b79b4c9eb5679b9f30704350849eddeeba671a3f05b768fd247e83244b9a0d0db7666942df80612d7cb1a6050000000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  352.298209] binder: BINDER_SET_CONTEXT_MGR already set
[  352.303882] binder: 14887:14890 ioctl 40046207 0 returned -16
[  352.309052] binder: 14888:14892 ioctl c0306201 0 returned -14
[  352.318953] binder: 14887:14890 got transaction with invalid offsets size, 2
[  352.326335] binder: 14887:14890 transaction failed 29201/-22, size 120-2 line 3338
[  352.336043] binder: undelivered TRANSACTION_ERROR: 29201
[  352.373932] binder: BINDER_SET_CONTEXT_MGR already set
[  352.384310] binder: 14902:14904 ioctl 40046207 0 returned -16
[  352.384779] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.384987] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.385155] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.385316] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.385475] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.385634] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.385991] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.386165] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.386327] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
[  352.386488] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=14901 comm=syz-executor.2
03:15:55 executing program 3:
ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000040))
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/raw6\x006\x9cHT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xe8\xbcU\xadLR\xf5 \xb0\xe8\x00\x00\x00\x00\x00\x00\x00\x00')
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x84100, 0x0)

03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0x0, r0, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r1, &(0x7f0000000200), 0x400000)
gettid()
close(0xffffffffffffffff)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='cgroup.procs\x00', 0x2, 0x0)
getpid()

03:15:55 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
fcntl$addseals(r1, 0x409, 0x4)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x800, 0x0)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f00000002c0)=""/4096)
r2 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
write$FUSE_POLL(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, 0x5, {0x5}}, 0x18)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)

03:15:55 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
sendfile(r1, r2, &(0x7f0000000000), 0xffffffff80000001)
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r1 = socket$inet6(0xa, 0x3, 0x87)
vmsplice(r0, &(0x7f0000000040)=[{&(0x7f0000000580)="6aebe81cc5e4ed72d0e2d716952f4ec837006a05ac622851e230ebadee86f8cb0c69af982994a75b93a36427f1da5557a00237a6f0b5af1eb8e1cc755fe8dd125a8fe9d7f1413cf426ea6137ba545b2b04aa904752ab0862520e52", 0x5b}], 0x1, 0x1)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x19, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x11}, @ldst={0x0, 0x0, 0x3, 0xa, 0xa, 0x0, 0x10}, @exit]}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0x31, &(0x7f00000000c0)=""/49, 0x80000, 0x2, [], 0x0, 0x13, r0, 0x8, &(0x7f0000000100)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0xf, 0x9, 0x8}, 0x10}, 0x70)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
r5 = socket$inet(0x2, 0x8000a, 0x1f)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = getpid()
fcntl$lock(r6, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r7})
listen(r6, 0x200)
r8 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r8, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r9 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r8, r9)
poll(&(0x7f0000000200)=[{r1, 0x484}, {r2, 0x1}, {r4, 0x80}, {r5, 0xc9d0}, {r6, 0x4}, {r9}], 0x6, 0x9)
readv(r0, &(0x7f0000000880), 0x0)

03:15:55 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = getpid()
fcntl$lock(r3, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r4})
listen(r3, 0x200)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000100)={@rand_addr="82b7c3734572b2f2c3f1c175aee0514d", 0x7, 0x1, 0x3, 0x9, 0x3f, 0xf5ed}, 0x20)
r5 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  354.740625] binder: BINDER_SET_CONTEXT_MGR already set
[  354.775713] binder: 14922:14927 ioctl 40046207 0 returned -16
03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  354.865180] binder: BINDER_SET_CONTEXT_MGR already set
[  354.874540] binder: 14949:14952 ioctl 40046207 0 returned -16
[  354.882499] binder: 14949:14952 got transaction with invalid offsets size, 2
[  354.897620] binder: 14950:14955 not enough space to store 0 fds in buffer
[  354.897648] binder: 14950:14955 transaction failed 29201/-22, size 120-24 line 3475
[  354.897935] binder: undelivered TRANSACTION_ERROR: 29201
[  354.925551] binder: 14949:14952 transaction failed 29201/-22, size 120-2 line 3338
[  354.940389] binder: undelivered TRANSACTION_ERROR: 29201
03:15:55 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
quotactl(0x40000080000103, 0x0, 0x0, 0x0)

03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:15:55 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
readv(r0, &(0x7f0000000880), 0x1)

03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

03:15:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{}, "487356e02f5a054d", "2354056f15b39bd4b4d8a116e539b38f", "17ec68f8", "48c9637b836f915a"}, 0x28)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000001540)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/250, 0xfa}, {&(0x7f00000014c0)=""/73, 0x49}], 0x3, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$inet_tcp_int(r4, 0x6, 0x0, &(0x7f00000000c0), &(0x7f0000000380)=0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @empty, 0x9}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340)=[@mss={0x2, 0x3}], 0x1)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x1ff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
syz_read_part_table(0x5, 0x1, &(0x7f00000002c0))
ioctl$sock_netdev_private(r0, 0x89fa, &(0x7f00000001c0)="1b5f49f881228defc3efd4cca49a9e99d5d6df33d0d864b94a2c368c06d97ca8a5de14c51545690ec7b1d9393dea7a2ba262f1c11b29f8901c45508de32c1c69d63e8fb25364023dc1e10ebcb1c72276bd15607cc0fb93cee50ec06e956aa8f92dcdd081c2595d60071b2d6262b84bb21acfed03fc19865193e0ba000726f98298a827ee3e2b3d38e0031a")
ptrace$cont(0x12, 0x0, 0x3, 0x3)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:15:55 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @flat=@handle={0x73682a85, 0x1000, 0x2}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x1e, 0x50}}}], 0x0, 0x0, 0x0})

03:15:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:55 executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x87)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(r2, 0x200)
recvmmsg(r2, &(0x7f0000009680)=[{{&(0x7f0000000200)=@xdp, 0x80, &(0x7f0000000380)=[{&(0x7f0000000280)=""/64, 0x40}], 0x1, &(0x7f00000003c0)=""/20, 0x14}, 0x2}, {{&(0x7f0000000400)=@nl=@proc, 0x80, &(0x7f0000000780)=[{&(0x7f0000000480)=""/33, 0x21}, {&(0x7f00000005c0)=""/68, 0x44}, {&(0x7f0000000640)=""/203, 0xcb}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000740)}], 0x5}, 0x1}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000800)=""/74, 0x4a}, {&(0x7f00000018c0)=""/249, 0xf9}, {&(0x7f00000019c0)=""/76, 0x4c}, {&(0x7f0000001a40)=""/106, 0x6a}, {&(0x7f0000001ac0)=""/145, 0x91}, {&(0x7f0000001b80)=""/5, 0x5}, {&(0x7f0000001bc0)=""/141, 0x8d}, {&(0x7f0000001c80)=""/147, 0x93}, {&(0x7f0000001d40)=""/85, 0x55}], 0x9, &(0x7f0000001e80)=""/30, 0x1e}, 0x8}, {{0x0, 0x0, &(0x7f0000004440)=[{&(0x7f0000001ec0)=""/49, 0x31}, {&(0x7f0000001f00)=""/4096, 0x1000}, {&(0x7f0000002f00)=""/175, 0xaf}, {&(0x7f0000002fc0)=""/210, 0xd2}, {&(0x7f00000030c0)=""/240, 0xf0}, {&(0x7f00000031c0)=""/4096, 0x1000}, {&(0x7f00000041c0)=""/169, 0xa9}, {&(0x7f0000004280)=""/178, 0xb2}, {&(0x7f0000004340)=""/12, 0xc}, {&(0x7f0000004380)=""/141, 0x8d}], 0xa, &(0x7f0000004500)=""/156, 0x9c}, 0x7}, {{&(0x7f00000045c0)=@isdn, 0x80, &(0x7f0000004740)=[{&(0x7f0000004640)=""/212, 0xd4}], 0x1, &(0x7f0000004780)=""/107, 0x6b}, 0x9}, {{&(0x7f0000004800)=@rc, 0x80, &(0x7f0000006e00)=[{&(0x7f0000004880)=""/217, 0xd9}, {&(0x7f0000004980)=""/4096, 0x1000}, {&(0x7f0000005980)=""/4096, 0x1000}, {&(0x7f0000006980)=""/206, 0xce}, {&(0x7f0000006a80)=""/255, 0xff}, {&(0x7f0000006b80)=""/186, 0xba}, {&(0x7f0000006c40)=""/90, 0x5a}, {&(0x7f0000006cc0)=""/58, 0x3a}, {&(0x7f0000006d00)=""/107, 0x6b}, {&(0x7f0000006d80)=""/113, 0x71}], 0xa, &(0x7f0000006ec0)=""/129, 0x81}, 0x4}, {{0x0, 0x0, &(0x7f0000007140)=[{&(0x7f0000006f80)=""/90, 0x5a}, {&(0x7f0000007000)=""/250, 0xfa}, {&(0x7f0000007100)=""/30, 0x1e}], 0x3, &(0x7f0000007180)=""/123, 0x7b}, 0x6}, {{&(0x7f0000007200)=@alg, 0x80, &(0x7f0000009280)=[{&(0x7f0000007280)=""/4096, 0x1000}, {&(0x7f0000008280)=""/4096, 0x1000}], 0x2, &(0x7f00000092c0)=""/226, 0xe2}, 0x2}, {{&(0x7f00000093c0)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000009580)=[{&(0x7f0000009440)=""/76, 0x4c}, {&(0x7f00000094c0)=""/181, 0xb5}], 0x2, &(0x7f00000095c0)=""/170, 0xaa}, 0xc627}], 0x9, 0x42, &(0x7f00000098c0)={0x0, 0x1c9c380})
fsetxattr(r1, &(0x7f0000009900)=ANY=[@ANYBLOB="747275737465642e6e65742f72617736004854f4fa92ca481c69cc75ae4a60335b7bdfdcde84f0bd5596bd31313d2a77818d1c8204996edfbc44e67b0904af925700e4777426ff2dae1900970a53e5af755f73f6f7145007e3c0ede238462f53ccccea650d975ad15130a8416a15aff0c936624aee48250f3d0182f0309b45219ebf1277cbc1d0f12af9e7c61558654c3cbc92180963744760b3c7d375491c23fa9295cad6a339d1f067e2210c5c3b714f97ceccbc55ad4c52f520b0e80061379f4616289ea1a469227d05b129a099f9a2ac8c8a3b07b15cd7b387355a999ed5fca63809f1000000"], &(0x7f00000000c0)='\x00', 0x1, 0x1)
socket$inet6(0xa, 0x3, 0x87)
sendto$inet6(r0, &(0x7f0000000100)="2b225e8f6ac60c82a67901dfa6e8d8181bbfe3e63ebc7742a4a93d2913c5cf4acd4086d9958a25e11ca3ac6dd9a47e47bf56d6cb70cd3bcf410a638bc2f1c2f4cd7c70cb8a82482666755007a52ba48359e942a9701a1d47c3b6c50afeaff1faea0643c5f67f61081fc39edcbdfafacfa870cf83705d383a3fa87d09b4e8a4ff7425eb508dc009ae15f3ea17543700f7fc9e8f5439b599e32d92f92df0919be081c984c63d1f7987add894f4d467ce", 0xaf, 0x8001, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @ipv4={[], [], @broadcast}, 0x83e}, 0x1c)
readv(r1, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:55 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xb6, 0x80000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r0, &(0x7f0000000200), 0x400000)
gettid()

[  355.062100] binder: 14959:14968 got transaction with invalid offset (0, min 0 max 0) or object.
[  355.075837] binder: 14959:14968 transaction failed 29201/-22, size 0-24 line 3379
[  355.093583] binder: undelivered TRANSACTION_ERROR: 29201
03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

03:15:55 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r5)
r6 = add_key(&(0x7f0000000140)='nig_key\x00', &(0x7f0000000280)={'4\xde\x10', 0x1}, 0x0, 0x0, r5)
fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000480)='y\x00', 0x2, 0x2)
keyctl$update(0x2, r6, &(0x7f00000002c0)="54317eae1a9687b70d811317e1a19666578652518498c33f832a11bf06fe74eb463cfdb947309985a522ab51b6b08b83bbb30255d54dd9738a0e1f823f6a05640e7ac817dab6053594b39b", 0x4b)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r7)
r8 = accept4$unix(r3, 0x0, &(0x7f0000000100), 0x80000)
r9 = fcntl$dupfd(0xffffffffffffffff, 0x766f25c7a035e4a9, r8)
ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000000200000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000330000000000000001000000000000000000000000002000852a7470000000000000000000000000800200000000000000000000000000000000000000000000852a7470000100000000000000000000d10300000000000000000000000000000000000000000000bb7e77d963d2c97b63dac89ca00c2e3c11000000000000000721355c8f5efa6d0cd166f52d795e"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="f9c48fb1ed30aae3a55a8513e6111f4c533f3d1770a8c2642e33b3c0dffde465bc012240ac1f2c3a7a200c5ebfabecae0d8739bea972fb953e5e811da90800000008000000168330686bc1bdf5a9703b17216a5b0f89b24c98d873d85b939850e53a0e85a1841c7540a928dd4df99ecf4dd4cf1970319ca0274f07d5f76bbe32a43f57962b98dda0ddec430bdcb10f7961e8591434c0c093b9626a3ce8b1a2e6594897dc9184637c5717477c6d5cc7265d415cc32d4f913686a31a81a61f462a40799324e1fc7bed9fe14de7d6cf8798595dc69f3a2b79f039cce38dbf88eed9454e7fe062e44014a9c4f24406070679"], 0x0, 0x0, 0x0})

03:15:55 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
accept4$inet6(r0, 0x0, &(0x7f0000000100), 0xc00)
readv(r0, &(0x7f0000000880)=[{0x0, 0x1c4}, {&(0x7f0000000000)=""/207, 0xcf}], 0x1000000e)

[  355.109614] binder: 14973:14976 not enough space to store 0 fds in buffer
03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

[  355.113328] binder: BINDER_SET_CONTEXT_MGR already set
03:15:55 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000000)=""/34}, {&(0x7f0000000040)=""/76}, {&(0x7f00000000c0)=""/217}, {&(0x7f00000001c0)=""/90}, {&(0x7f00000008c0)=""/4096}], 0x100000f6)

03:15:55 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x3, r2}]]}}}]}, 0x38}}, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0)
pipe(&(0x7f0000000000))

03:15:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  355.113335] binder: 14972:14978 ioctl 40046207 0 returned -16
[  355.113936] binder: 14972:14978 got transaction with invalid offsets size, 2
[  355.114012] binder: 14972:14978 transaction failed 29201/-22, size 120-2 line 3338
[  355.114202] binder: undelivered TRANSACTION_ERROR: 29201
03:15:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:55 executing program 2:
r0 = socket$inet6(0xa, 0x80003, 0x7f)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000180)={@ipv4={[], [], @multicast2}}, 0x14)

[  355.159570] binder: 14984:14988 got transaction with invalid offset (0, min 0 max 0) or object.
[  355.159597] binder: 14984:14988 transaction failed 29201/-22, size 0-24 line 3379
[  355.159734] binder: undelivered TRANSACTION_ERROR: 29201
[  355.170921] binder: BINDER_SET_CONTEXT_MGR already set
[  355.170932] binder: 14987:14993 ioctl 40046207 0 returned -16
[  355.185587] binder_alloc: 13628: binder_alloc_buf size -2041765683614726784 failed, no address space
[  355.185594] binder_alloc: allocated: 160 (num: 3 largest: 144), free: 12128 (num: 1 largest: 12128)
[  355.185764] binder: 14987:14993 transaction failed 29201/-28, size 120-2 line 3284
[  355.186680] binder: undelivered TRANSACTION_ERROR: 29201
[  355.195195] binder: BINDER_SET_CONTEXT_MGR already set
[  355.195203] binder: 14987:14998 ioctl 40046207 0 returned -16
[  355.198033] binder_alloc: 13628: binder_alloc_buf size -2041765683614726784 failed, no address space
[  355.198040] binder_alloc: allocated: 160 (num: 3 largest: 144), free: 12128 (num: 1 largest: 12128)
[  355.198057] binder: 14987:14998 transaction failed 29201/-28, size 120-2 line 3284
[  355.198405] binder: undelivered TRANSACTION_ERROR: 29201
[  355.234575] binder: 15002:15003 got transaction with invalid offset (0, min 0 max 0) or object.
[  355.234599] binder: 15002:15003 transaction failed 29201/-22, size 0-24 line 3379
[  355.234812] binder: undelivered TRANSACTION_ERROR: 29201
03:15:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:56 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x16)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = socket$inet6(0xa, 0x3, 0x87)
ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f00000000c0)={'bcsh0\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xe}}})
readv(r1, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'syz_tun\x00'}, 0x18)

03:15:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:56 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xb6, 0x80000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(0x0, 0x0, 0x0, r1, 0x0)
perf_event_open$cgroup(0x0, r0, 0x0, 0xffffffffffffffff, 0x8)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r2, &(0x7f0000000200), 0x400000)
close(0xffffffffffffffff)
gettid()
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='cgroup.procs\x00', 0x2, 0x0)

03:15:56 executing program 0:
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x55040000, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0)

[  355.298547] binder: 15011:15014 not enough space to store 0 fds in buffer
[  355.298576] binder: 15011:15014 transaction failed 29201/-22, size 120-24 line 3475
[  355.298795] binder: undelivered TRANSACTION_ERROR: 29201
[  355.452820] binder: 14973:14976 transaction failed 29201/-22, size 120-24 line 3475
[  355.462546] binder: undelivered TRANSACTION_ERROR: 29201
03:15:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

03:15:56 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000018c0)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000005804000000000000000000004001000070030000700300007003000004000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYBLOB="7f000001e0000001ff00007fff000000000000000000000000000000000000000000000000000000ff00000000ff00000000000000000000aaaaaaaaaa14000000000000000000000000000000000000ffff00ff00ff00000000000000000000000001000008010007ff00097465716c3000000000000000000000007665740000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f60000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000ffffffffffff000000000000000000000000000000000000000000000000000000000928ac1414bb0f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0001801000000000000000000000000000000000000000000000000020028004e465155455545000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000307000200010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x3)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = getpid()
fcntl$lock(r1, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r2})
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
recvfrom$inet6(r3, &(0x7f0000000000)=""/51, 0x33, 0x2000, 0x0, 0x0)
listen(r1, 0x200)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000100)=""/190, 0xbe}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/92, 0x5c}], 0x3)
pipe2(&(0x7f0000000480)={<r4=>0xffffffffffffffff}, 0x80000)
setsockopt$inet6_icmp_ICMP_FILTER(r4, 0x1, 0x1, &(0x7f00000005c0), 0x4)

[  355.497012] binder: 15025:15029 not enough space to store 0 fds in buffer
[  355.506426] binder: 15025:15029 transaction failed 29201/-22, size 120-24 line 3475
[  355.516704] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0)
03:15:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

03:15:56 executing program 0:
syz_emit_ethernet(0x3e, &(0x7f0000000200)={@broadcast, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @multicast1=0xe000fc00}, @icmp=@source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @dev}}}}}}, 0x0)

[  355.516710] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[  355.517080] F2FS-fs (loop0): invalid crc_offset: 0
[  355.517194] F2FS-fs (loop0): invalid crc_offset: 0
[  355.517203] F2FS-fs (loop0): Failed to get valid F2FS checkpoint
[  355.523179] binder: 15030:15039 not enough space to store 0 fds in buffer
[  355.523206] binder: 15030:15039 transaction failed 29201/-22, size 120-24 line 3475
[  355.523430] binder: undelivered TRANSACTION_ERROR: 29201
[  355.572832] binder: 15040:15041 got transaction with invalid offset (0, min 0 max 0) or object.
[  355.572860] binder: 15040:15041 transaction failed 29201/-22, size 0-24 line 3379
[  355.573174] binder: undelivered TRANSACTION_ERROR: 29201
[  355.650537] binder: 15047:15051 got transaction with invalid offset (0, min 0 max 0) or object.
[  355.652663] binder: undelivered TRANSACTION_ERROR: 29201
[  355.671475] binder: 15047:15051 transaction failed 29201/-22, size 0-24 line 3379
[  355.681395] binder: undelivered TRANSACTION_ERROR: 29201
03:15:59 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@sack_perm], 0x1)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:15:59 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x3, r2}]]}}}]}, 0x38}}, 0x0)

03:15:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0})

03:15:59 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
mlockall(0x2)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x2, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x33, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x280}, @ptr={0x70742a85, 0x100, 0x0, 0x3d1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
sched_setattr(0xffffffffffffffff, &(0x7f0000000000)={0x30, 0x2, 0x0, 0x200, 0xff, 0x2, 0x80000001, 0x4}, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
socket$inet6(0xa, 0x3, 0x87)
ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000040)=""/68)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:59 executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x87)
r1 = gettid()
ioprio_set$pid(0x2, r1, 0x0)
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc)
r2 = fcntl$getown(r0, 0x9)
r3 = syz_open_procfs(r2, &(0x7f0000000240)='net/ip6_tablus_ta\tgets\x00')
socket$inet6(0xa, 0x3, 0x87)
readv(r3, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:59 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x2db020, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000001c0)="57162466da1866b7099d92a06bd2765814c8dbdbe986563fc61579c10cd60693a6fde7ac88872241d112d7339c537c460cd72e69928c81ac0e880b02ec1c3f4ef0f7089a1d8981108024149b809d8d90c3f25f306dc8eccc44a037f18ccdeda0b18da94b92eee1cd2e2451f661e58de31db2d0b47a13da0a7ab43fa6f7c3a87b0f795b997cdcad00e20a216de940fd70d4d480f0fc3b42bba6a94e161e89312b025d53a27856fc1ea52101691f9da221f32218b72969753709a048f30c75053ebe79f6fb6eb4e1392a63f1e9abd73e818a41160ed583de936c5d4d74df59f844be3f6a96cabe102541f82b7c74e648edd65ef1d0d20f9fa0663ae841dd6d1121")
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x0, 0x4000007, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)

03:15:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  358.321993] binder: 15059:15063 got transaction with invalid offset (0, min 0 max 0) or object.
[  358.336103] binder: 15061:15065 got transaction with invalid offsets size, 2
03:15:59 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x3, r2}]]}}}]}, 0x38}}, 0x0)

03:15:59 executing program 3:
r0 = socket$inet6(0xa, 0x3, 0x87)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = getpid()
fcntl$lock(r3, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r4})
listen(r3, 0x200)
r5 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000280)=0xfffffffffffffef2)
ioctl$TUNSETGROUP(r2, 0x400454ce, r7)
r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080)='devlink\x00')
sendmsg$DEVLINK_CMD_GET(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r8, 0x0, 0x70bd28, 0x25dfdbfe, {}, [{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x8040}, 0x8000)
getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x26, &(0x7f0000000200)={@loopback, @dev, @local}, &(0x7f0000000240)=0xc)
r9 = dup(r0)
ioctl$RNDADDENTROPY(r9, 0x40085203, &(0x7f00000003c0)=ANY=[])
socket$inet6(0xa, 0x3, 0x87)
readv(r1, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0xffffffffffffe31)

03:15:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
fstat(r1, &(0x7f0000000140))
socket$inet6(0xa, 0x3, 0x87)
readv(r0, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
getpeername(r4, &(0x7f0000000c80)=@hci={0x1f, <r7=>0x0}, &(0x7f0000000d00)=0x80)
r8 = getuid()
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000d40)={{{@in6=@mcast1, @in6=@ipv4={[], [], @loopback}, 0x4e21, 0x407, 0x4e24, 0x0, 0x2, 0x100, 0x80, 0x0, r7, r8}, {0x7fffffff, 0x8001, 0x1000, 0x9, 0x9, 0x7f, 0xff, 0xfb58}, {0x8, 0x8000, 0x40, 0x5}, 0x1, 0x6e6bb7, 0x0, 0x0, 0x3, 0x1}, {{@in=@local, 0x4d5, 0xff}, 0x2, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3506, 0x3, 0x0, 0xf8, 0x6, 0x2, 0x3}}, 0xe8)
r9 = getpgrp(0x0)
r10 = gettid()
rt_sigprocmask(0x0, &(0x7f0000000040)={0xfffffffffffffffe}, 0x0, 0x8)
rt_tgsigqueueinfo(r9, r10, 0x12, &(0x7f0000000180)={0x0, 0x0, 0x2000000040004})
r11 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={0xfffffffffffffdae}, 0x8, 0x0)
read(r11, &(0x7f0000000100)=""/128, 0xff56)
r12 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r12, 0x0, 0x0)
r13 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r14=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r12, 0x400454ce, r14)
symlinkat(&(0x7f0000000000)='./file0\x00', r12, &(0x7f0000000080)='./file0\x00')

[  358.336129] binder: 15061:15065 transaction failed 29201/-22, size 120-2 line 3338
[  358.336546] binder: undelivered TRANSACTION_ERROR: 29201
[  358.342784] binder: 15060:15071 got transaction with out-of-order buffer fixup
03:15:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  358.342807] binder: 15060:15071 transaction failed 29201/-22, size 120-24 line 3467
[  358.343013] binder: undelivered TRANSACTION_ERROR: 29201
[  358.421058] binder: 15078:15087 got transaction with out-of-order buffer fixup
[  358.421083] binder: 15078:15087 transaction failed 29201/-22, size 120-24 line 3467
[  358.421312] binder: undelivered TRANSACTION_ERROR: 29201
[  358.430948] binder: 15076:15084 ioctl 41009432 200001c0 returned -22
[  358.431261] binder: 15076:15084 not enough space to store 0 fds in buffer
[  358.431284] binder: 15076:15084 transaction failed 29201/-22, size 120-24 line 3475
[  358.434377] binder: undelivered TRANSACTION_ERROR: 29201
[  358.484879] binder: 15095:15099 got transaction with out-of-order buffer fixup
[  358.484908] binder: 15095:15099 transaction failed 29201/-22, size 120-24 line 3467
[  358.485236] binder: undelivered TRANSACTION_ERROR: 29201
[  358.542000] binder: release 15103:15105 transaction 1229 out, still active
[  358.542005] binder: undelivered TRANSACTION_COMPLETE
[  358.554267] binder: send failed reply for transaction 1229, target dead
[  358.661865] binder: 15059:15063 transaction failed 29201/-22, size 0-24 line 3379
03:15:59 executing program 3:
socket$inet6(0xa, 0x3, 0x87)
r0 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r1 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r0, r1)
getsockopt$inet6_buf(r0, 0x29, 0x7, &(0x7f0000000000)=""/216, &(0x7f0000000100)=0xd8)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000140))
socket$inet6(0xa, 0x3, 0x87)
inotify_init1(0x800)
readv(r2, &(0x7f0000000880)=[{0x0}, {&(0x7f00000004c0)=""/196, 0xc4}], 0x2)

03:15:59 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:15:59 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x20, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:15:59 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00')
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x8, 0x2, 0x15}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x29a, 0x0, 0x0})

03:15:59 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000000000000000000000000000000000000000000000000000000000000000000085616466000000000000000000000000010000003f0000000000000000000000e66fe80cdf7d293437a1b5f74c14c653c0c89a7eba2d"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  358.671868] binder: undelivered TRANSACTION_ERROR: 29201
[  358.692180] binder: BINDER_SET_CONTEXT_MGR already set
[  358.705365] binder: 15111:15115 ioctl 40046207 0 returned -16
[  358.705556] binder: release 15113:15118 transaction 1231 out, still active
[  358.705561] binder: undelivered TRANSACTION_COMPLETE
[  358.712495] binder: send failed reply for transaction 1231, target dead
[  358.734132] binder: 15120:15121 not enough space to store 0 fds in buffer
[  358.734155] binder: 15120:15121 transaction failed 29201/-22, size 120-24 line 3475
[  358.734369] binder: undelivered TRANSACTION_ERROR: 29201
[  358.772802] binder: 15125:15127 got transaction with invalid parent offset or type
[  358.781238] binder: 15125:15127 transaction failed 29201/-22, size 120-24 line 3454
[  358.790066] binder: undelivered TRANSACTION_ERROR: 29201
[  358.796505] binder: 15125:15128 got transaction with invalid parent offset or type
[  358.804604] binder: 15125:15128 transaction failed 29201/-22, size 120-24 line 3454
[  358.813035] binder: undelivered TRANSACTION_ERROR: 29201
03:16:02 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x7808200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:02 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
fsetxattr$security_ima(r1, &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@sha1={0x1, "c1d6c6de5f33295e153cdd9589c39ee42f99e15b"}, 0x15, 0x0)
r4 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=0000 000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
write$binfmt_misc(r0, &(0x7f0000000140)={'syz1', "c4085bddbb82de2016a8b19974a7889f25073a6ac24efa10c9e372031cd34765b003c5cc6cb6712771337d60d386b2be5ec3f269e43d104749c7ba09e99b95b989a462b7816d7830cfa037eb5c38205fa8af8497ec9b345d1a0a2a62707bad41589d88a114f96b078f"}, 0x6d)
sendfile(r5, r4, 0x0, 0x8000fffffffe)

03:16:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_SET(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)={0x194, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x3}}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="a4000000a7b0a8df027b6f9b6a506a7b03000000cb", @ANYRES16=r3, @ANYBLOB="080029bd7000fedbdf2506000000100001006e657464657673696d000000100002006e657464657673696d30000008000300030000000800040000000000100001006e657464657673696d000000100002006e657464657673696d30000008000300030000000800040003000000100001006e657464657673696d000000100002006e657464657673696d30000008000300010000000800040001000000"], 0xa4}, 0x1, 0x0, 0x0, 0x60000000}, 0x20000000)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0})

03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

[  361.412053] binder: release 15131:15137 transaction 1239 out, still active
[  361.416624] binder: 15135:15139 not enough space to store 0 fds in buffer
[  361.416649] binder: 15135:15139 transaction failed 29201/-22, size 120-24 line 3475
[  361.440324] binder: undelivered TRANSACTION_COMPLETE
03:16:02 executing program 0:
creat(&(0x7f0000000040)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x4, 0x1000f3)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = geteuid()
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r3)
chown(&(0x7f0000000000)='./file0\x00', r1, r3)
fstat(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
chown(&(0x7f0000000240)='./file0\x00', r1, r4)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
fchdir(r5)
r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x450000, 0x0)
sendmsg$TIPC_NL_BEARER_GET(r6, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x1bc, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xf4, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x810}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6a0}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x401}]}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb47d}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3801bdfd}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xb5c}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x1bc}, 0x1, 0x0, 0x0, 0x20000000}, 0x40)

03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

[  361.463963] binder: undelivered TRANSACTION_ERROR: 29201
[  361.469334] binder: 15134:15142 not enough space to store 0 fds in buffer
[  361.469360] binder: 15134:15142 transaction failed 29201/-22, size 112-24 line 3475
[  361.474727] binder: BINDER_SET_CONTEXT_MGR already set
[  361.474736] binder: 15134:15150 ioctl 40046207 0 returned -16
[  361.488916] binder: BINDER_SET_CONTEXT_MGR already set
[  361.488924] binder: 15148:15155 ioctl 40046207 0 returned -16
[  361.489326] binder_alloc: 15135: binder_alloc_buf, no vma
[  361.489343] binder: 15148:15155 transaction failed 29189/-3, size 120-24 line 3284
[  361.494986] binder: BINDER_SET_CONTEXT_MGR already set
03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:16:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x1, 0x40080)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000140)=0xe8)
setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@local, @in=@broadcast, 0x4e24, 0x0, 0x4e21, 0x5, 0xa, 0x80, 0xd0, 0x6c, 0x0, r4}, {0x2, 0x2, 0x3, 0x1, 0x0, 0x4, 0x51e8, 0x800000000000}, {0x5, 0x745, 0x6}, 0x8, 0x6e6bbb, 0x1, 0x0, 0x1, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d5, 0x3c}, 0xa, @in6=@loopback, 0x3507, 0x0, 0x2, 0x7, 0x101, 0x5, 0x1}}, 0xe8)

03:16:02 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
geteuid()
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:02 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = geteuid()
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
rmdir(&(0x7f0000000040)='./bus\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB='=00000000000000000140000,user_id=\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',blksize=0x0000000000000200,mask=^MAY_EXEC,\x00'])
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r5)
chown(&(0x7f0000000000)='./file0\x00', r3, r5)
ioprio_set$uid(0x3, r3, 0x2db)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  361.495002] binder: 15149:15154 ioctl 40046207 0 returned -16
[  361.495923] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.495942] binder: 15149:15154 transaction failed 29189/-3, size 112-0 line 3284
[  361.563561] binder: BINDER_SET_CONTEXT_MGR already set
[  361.563569] binder: 15163:15167 ioctl 40046207 0 returned -16
[  361.563818] binder_alloc: 15131: binder_alloc_buf, no vma
03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x10001, 0x9, 0xe, 0x8, "73e9d6a022f046677126e5dc668cf09c1a3a3602750796026e2173b15b87ef645d03e37ca6a7504f32a3a381e7e729e43e32780c5c2572594d792689cedf5667", "0780087babfad30d2ab719a4033181bc7a6741bde761ded46b3dfa16953a783f", [0x6, 0x81]})
fcntl$setpipe(r1, 0x407, 0x2)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="001100000f005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  361.563836] binder: 15163:15167 transaction failed 29189/-3, size 112-0 line 3284
[  361.573141] binder: BINDER_SET_CONTEXT_MGR already set
[  361.573149] binder: 15162:15166 ioctl 40046207 0 returned -16
[  361.573350] binder_alloc: 15134: binder_alloc_buf, no vma
[  361.573366] binder: 15162:15166 transaction failed 29189/-3, size 120-24 line 3284
[  361.574929] binder: BINDER_SET_CONTEXT_MGR already set
03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  361.574935] binder: 15162:15166 ioctl 40046207 0 returned -16
[  361.714427] binder: BINDER_SET_CONTEXT_MGR already set
[  361.714436] binder: 15175:15180 ioctl 40046207 0 returned -16
[  361.714701] binder_alloc: 15131: binder_alloc_buf, no vma
03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  361.714720] binder: 15175:15180 transaction failed 29189/-3, size 112-0 line 3284
03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r2)
r3 = geteuid()
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r5)
chown(&(0x7f0000000000)='./file0\x00', r3, r5)
ioprio_get$uid(0x3, r3)
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$UI_DEV_CREATE(r6, 0x5501)
r7 = add_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="fb63b9698c30f44369dff66885ced2a8f0b7fc7f685e7097b206a1b612984f6915f907858ba39d4d52b1115f7f72c40ed66249c85de2bbc17c", 0x39, 0xfffffffffffffffc)
r8 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r8)
keyctl$KEYCTL_MOVE(0x1e, r2, r7, r8, 0x3)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:02 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

03:16:02 executing program 3:
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f00000000c0)=0x18, 0x4)
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000064f3df2800ff00000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  361.732242] binder: BINDER_SET_CONTEXT_MGR already set
[  361.732249] binder: 15174:15178 ioctl 40046207 0 returned -16
[  361.733080] binder_alloc: 15135: binder_alloc_buf, no vma
[  361.733097] binder: 15174:15178 transaction failed 29189/-3, size 120-24 line 3284
03:16:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000140)={0x7, 0x4, 0x8001, 0xda96, 0x1a, 0xc1, 0x1, 0x6b, 0x40, 0x5, 0xe3b, 0x3})
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  361.737953] binder: BINDER_SET_CONTEXT_MGR already set
[  361.737961] binder: 15176:15184 ioctl 40046207 0 returned -16
[  361.738782] binder_alloc: 15134: binder_alloc_buf, no vma
[  361.738799] binder: 15176:15184 transaction failed 29189/-3, size 120-24 line 3284
[  361.783918] binder: BINDER_SET_CONTEXT_MGR already set
[  361.783926] binder: 15189:15192 ioctl 40046207 0 returned -16
03:16:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0xa)
getpeername(r2, &(0x7f0000001680)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000001700)=0x80)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  361.791449] binder_alloc: 15135: binder_alloc_buf, no vma
[  361.791468] binder: 15189:15192 transaction failed 29189/-3, size 120-24 line 3284
[  361.791958] binder: BINDER_SET_CONTEXT_MGR already set
[  361.791965] binder: 15187:15190 ioctl 40046207 0 returned -16
[  361.792439] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.792457] binder: 15187:15190 transaction failed 29189/-3, size 120-24 line 3284
[  361.793384] binder: BINDER_SET_CONTEXT_MGR already set
[  361.793391] binder: 15187:15190 ioctl 40046207 0 returned -16
[  361.793639] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.793654] binder: 15187:15190 transaction failed 29189/-3, size 120-24 line 3284
[  361.811807] binder: BINDER_SET_CONTEXT_MGR already set
[  361.811816] binder: 15176:15196 ioctl 40046207 0 returned -16
[  361.812538] binder_alloc: 15134: binder_alloc_buf, no vma
[  361.812557] binder: 15176:15196 transaction failed 29189/-3, size 120-24 line 3284
[  361.856904] binder: BINDER_SET_CONTEXT_MGR already set
[  361.856913] binder: 15200:15202 ioctl 40046207 0 returned -16
[  361.874192] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.874208] binder: 15200:15202 transaction failed 29189/-3, size 120-24 line 3284
[  361.876747] binder: BINDER_SET_CONTEXT_MGR already set
[  361.876756] binder: 15199:15204 ioctl 40046207 0 returned -16
[  361.878013] binder_alloc: 15135: binder_alloc_buf, no vma
[  361.878038] binder: 15199:15204 transaction failed 29189/-3, size 120-24 line 3284
[  361.882368] binder: BINDER_SET_CONTEXT_MGR already set
[  361.882376] binder: 15200:15205 ioctl 40046207 0 returned -16
[  361.907821] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.907838] binder: 15200:15209 transaction failed 29189/-3, size 120-24 line 3284
[  361.937136] binder_alloc: 15134: binder_alloc_buf, no vma
[  361.937155] binder: 15210:15213 transaction failed 29189/-3, size 120-24 line 3284
[  361.940888] binder_alloc: 15134: binder_alloc_buf, no vma
[  361.940903] binder: 15210:15216 transaction failed 29189/-3, size 120-24 line 3284
[  361.946514] binder: BINDER_SET_CONTEXT_MGR already set
[  361.946521] binder: 15212:15217 ioctl 40046207 0 returned -16
[  361.947036] binder_alloc: 15135: binder_alloc_buf, no vma
[  361.947051] binder: 15212:15217 transaction failed 29189/-3, size 120-24 line 3284
[  361.966120] binder: BINDER_SET_CONTEXT_MGR already set
[  361.966128] binder: 15215:15218 ioctl 40046207 0 returned -16
[  361.966453] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.966468] binder: 15215:15218 transaction failed 29189/-3, size 120-24 line 3284
[  361.967454] binder: BINDER_SET_CONTEXT_MGR already set
[  361.967462] binder: 15215:15220 ioctl 40046207 0 returned -16
[  361.967740] binder_alloc: 15131: binder_alloc_buf, no vma
[  361.967754] binder: 15215:15220 transaction failed 29189/-3, size 120-24 line 3284
[  362.037954] binder: BINDER_SET_CONTEXT_MGR already set
[  362.037960] binder: 15224:15225 ioctl 40046207 0 returned -16
[  362.038881] audit: type=1400 audit(1572146162.737:55): avc:  denied  { getattr } for  pid=15224 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1
[  362.039284] binder_alloc: 15134: binder_alloc_buf, no vma
[  362.039369] binder: 15224:15225 transaction failed 29189/-3, size 120-24 line 3284
[  362.051692] binder: BINDER_SET_CONTEXT_MGR already set
[  362.051701] binder: 15224:15226 ioctl 40046207 0 returned -16
[  362.054684] binder_alloc: 15134: binder_alloc_buf, no vma
[  362.054699] binder: 15224:15226 transaction failed 29189/-3, size 120-24 line 3284
[  362.330044] binder: undelivered TRANSACTION_ERROR: 29189
[  362.335513] binder: undelivered TRANSACTION_ERROR: 29189
[  362.341072] binder: undelivered TRANSACTION_ERROR: 29189
[  362.346687] binder: undelivered TRANSACTION_ERROR: 29189
[  362.352281] binder: undelivered TRANSACTION_ERROR: 29189
[  362.357915] binder: undelivered TRANSACTION_ERROR: 29189
[  362.363445] binder: undelivered TRANSACTION_ERROR: 29189
[  362.369076] binder: undelivered TRANSACTION_ERROR: 29189
[  362.374675] binder: undelivered TRANSACTION_ERROR: 29189
[  362.380267] binder: undelivered TRANSACTION_ERROR: 29189
[  362.385881] binder: undelivered TRANSACTION_ERROR: 29189
[  362.391585] binder: undelivered TRANSACTION_ERROR: 29189
[  362.397095] binder: undelivered TRANSACTION_ERROR: 29189
[  362.402728] binder: undelivered TRANSACTION_ERROR: 29189
[  362.408305] binder: undelivered TRANSACTION_ERROR: 29189
[  362.413915] binder: undelivered TRANSACTION_ERROR: 29189
[  362.419603] binder: undelivered TRANSACTION_ERROR: 29189
[  362.425195] binder: undelivered TRANSACTION_ERROR: 29189
[  362.430811] binder: undelivered TRANSACTION_ERROR: 29189
[  362.436405] binder: undelivered TRANSACTION_ERROR: 29189
[  362.442034] binder: undelivered TRANSACTION_ERROR: 29189
03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:03 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

03:16:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
socketpair(0x24, 0x80000, 0xf0, &(0x7f0000000100))
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:03 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x156acc05a0291fed, &(0x7f0000000040)=0x4, 0x4)
tkill(r4, 0x1e)
setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000000)=0x1000, 0x4)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xffffffffffffff07, 0x0, &(0x7f0000000240)=[@register_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/4096, 0x0, 0x0, 0x17}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000140)}, 0x1000}], 0x0, 0x0, 0x0})
r4 = creat(&(0x7f0000000000)='./file0\x00', 0x201)
r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='}\x00'}, 0x10)
r6 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
pipe2$9p(&(0x7f00000013c0)={<r7=>0xffffffffffffffff}, 0x800)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000026c0)={0x108, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="12634840020000000000000000000000000000000000000010000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32=r5, @ANYBLOB="000000000000000000000000852a62730a0000000100"/36], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="00020000000000000b630000106308400000000000000000056304400100000011634840020000000000000000000000000000000000000011000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000001400)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r6, @ANYBLOB="000000000000000000000000852a68730010000001000000000000000000000000000000852a646600000000", @ANYRES32=r7, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000001480)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="4000000000000000096310400300000000000000000000000000000000634040010000000000000000000000000000000000000001000000000000000000000050000000000000001800000000000000", @ANYPTR=&(0x7f0000002700)=ANY=[@ANYBLOB="852a62730000000003000000e8ff000000000000000000008561646600000000050000000000000001000000000000001100400000000000852a6877000000f3ff0000000000000000000000000000005b4376c67db1da738a99b5c910f7d6186ab382a1fba46f6817d6b0221de1e1a44e78e3f23e1a92bbab5c521ad4dd6b06b3e2da375f7d282917053f804824f4d3c2de5dfbf5b0b20acd98f0d51b5c449a012259d7215d"], @ANYPTR=&(0x7f0000001540)=ANY=[@ANYBLOB="000000000000000018000000000000003800000000000000"]], 0x1000, 0x0, &(0x7f00000016c0)="40096d208fa7e2525b07eae2311bc67b5fcc5395672f89e020106fcbef75284a40cdf75974f02e1e8bcbdb4cc4f275ead70d3020848d7da7ed560784870a4ef9790dca2327b38e0ed2a8fdb9cf9615207a651742cc490afff4d2175cb08048066e1f3cde021c3573731b8b5a12ad1a6a100f662e01e9e16e221e1004eca0fae00bf575a38ac07565a76164a5d1d894980b8e4c8025d342ca177537a6844b32e9bd43f54f232293e4c08bca5e8f21ebafb6f3eae32eb9e549bffd0eb91ba209c568ce89c75e41cf6a048f27bb5d3e9d08a2428e12fd5f9e77da9dd1f5577ecfecaf954463529470d60105cdbb6dc4b7ebca2955cc2276d2367dc73248c037b9ccea88f6dc469742149afed48753e24a39c8fe6381d8adf3eb5a8737e85e1e01b7d36e36fc8aa03bdd801800c2b41b3def92e7fd0c285a5457e1b26cf5b959cf26b4b503945189e9ba910c068272f491ea45f7cbbabd86ae1d23b52e2cb9990448264f5eaf3189aef347458f2d6d847aa00e447130888c9aa92a11007d9a19983db4c9d04f81a38f96b3fdc01563fb76b3eeba806c4e84274c8a8a16f9940a78e0917d99ef886aa099299e8bd6704f6194c3993f12469c99812ed204109809e50671f3b23bf81bd1940d7a06e6fc0c4bf28919a7c71234971b8342567124c4055e72eefd43dbdd0e5db52e879b3783bda1c2ed7a3a544ef009c1f41113b5ec815176e08f85dc15ed5da1b72aaf12d298c9d0ea9283945cb001d79f1491c9b27d3eeeb1f6f1d2e2b5ed83ac512e7b377d9653ece3f9b884fae69ff6f65cbf7e776847596f42b7ca764e19bbccdba63a5da829653e380d19bebddc4910fbf982fbd2f3b3185a619fd909240d985f477f14631579e5c6debb6ace03b7117fa396cfba6d059de620b6ab2675065dc5700f046f4ae5ea55dcfe4a7cedba81481fb1f5efc1b8dea820dd92faf48843e58fa92af246a9bf66399269956b41fa3b57b956d0b40078412e7b100c9dba2c16beb374f516d821b325da8af3b21d7ff286f7ed56e8febd3288879a3f7de7e82849b85c10edbf6e23161da725d3ecd50ce6696d7ae4b83c9e5ce733b1948b53a034a09b374561c3be3fc15fad5bb07045511b9700975ab2f1c464c7b490fe5b72d066ba1f817cc3f45170598f8a55a1a8ac4b232c2b9750358d295bfceb6db26421776942929d2691b98901f4164b048d1360064731204285cf4f2d58bbb0d063de44bcc3d05634f107548b34915cf6f67e4836e8d14b766f671a99ebe70379c59be18661a26b12c640740e8cd8e1fb161e4035b8244d7a3cdfc6b9db88f33df43db19c3ae68c739b2fcefab6b022b4fc7e93f25042a458f0efe885b0dbfb6e68c0d2596415263000cec8253b1d9e38c62f57f029bee727a257b4703df07333e3eefdaadb11696b0bb6b0d324c993e17c32c299ee8d86aff68db7b7d1c45ec3455b48fe311324ca833af5696284999cebaa1aa70c2af79cbcd910556d2861966d529c0e201a3f21c4265c804af7e7707f37d5c52d0d7fc09ed15fce0fbe12f0d82c69ece619a5d2a4847e321cf1fd806750a2c9e022212202a7a7e7a3ab41fa165fab2ad732c4a3d6e2805105f8d04299155b83aa74c74806d3bd410fe0e28a722efbde8ad4b5442ef4620038e1de603944124aceba12adca91b6c32748a5bda2517ce85f1e638687559d84952599ee3777388390edfee7d43b08d81fc44982fb7c93f707ca286b37ac5ab78967ec7b11fe8f8dc66ab20c50b679ee9a417a63a8d633c63b0ea83d04a0a1305ef872bb5395e3ec6b94f0128be849abc7ad0d7971265db5df974cece889f74c2212bf991bffb119b3318b65f8fe4a02061db0af5b9e1e0fbee54babc1966404088aa7541d6540f3f71fd771aa4bc09bfd32e010ba3894e6b2ec7ca2d6bc7985a1fb931ed7419ae4d19e56432e8cb830c7a8449db508ecda0e41e6e062c4065443531c874b32f7abc131e4b5683ba935e20453421200d07a042737bb99772d4dcc65818b37bd52270a2224ebd2574f5eeca6944281b0ae55dc6be0a4665392abda734c32d00357c31a7f60e856d683f53f45f5fdcc7b33fc53e722efee29c73c697bba400144b27bc8534098d25145459e8ce1b216f384f02f327c794cc5c505c77b3c9181e90ceceb8988e51ccb5a7db9513667f804311dd3f8078b4159e2ff5bea6109f70519aef884f03ddcd10fa7271e80275aed58162ed9618c33c123851fa45577dfb28f48cda50cee027507a1f57bbe8b421a0f1b05608ae2285a1fe56591135d427cd18273389b73308d734a4a00bfd9792040cbf7f569d97e24f51ab461452f48cfaff80506dda2ba721a737ca4e98adae84117c60153a8dbc4bbf42dc974d279e7c6fd8884e7d68df9463c0cde5559b7a1aa3941b0f4c96f518a6b4fe926fb93247a8e77fe8ee34b0e3b35571c6d63917b2d2ff6de2337cad62888ee0f888f1328fede711b2f28c3ac6bd61c4b062c6efc223d507d976f8c34527e277ced1af7293d53ab42df460a0389ed4e6c38dee2fdd26b0b4f0f103ab94fefa252406dde3187c20bd1dfdcc7493202c3a56d5c868bfc207821ef27ea3688980f14999226e97a1f80e1e5b242adb0bdc79a07fe4d1379ca5676e2118fa3a6659a6836112025067bb0f57216cb7106e792720a8483a032b11ac02584fd27da965d099adad92b39f3fc835b62d8c826fb376410a1ce66de6ddd50b19f391e7722fe24f906ef1adc38379d73fdf49b60b9260dda2e0b0dce78ea0527be92077fe7389ffc2d9b51857cd897f42355288152149487dc037ffe88d05ddef0a752627e8873a3b9968827ef60db938b72740b0a8c42529a90e3a20305a9d7c9a0f0f9373b9ed63eeac1242d5f75696ac7db933e24bbbf6ecba57e19be8ce6469a9caf64609a9e09e13ac1eceb6b3865e6bdaf8f35974f0de9122ddba92dc1ce058e869b7d7ee56ea13906c573b9b9c2782f7b2625f1c7af86aadaaa51fd5b327708b37739032c89e759006553df5bfedce9215fb7d0cf2f165243d974b780b370ae7062d2f37c028a9d4e2a360bfe01560dcf01b4dd30f4c8314168cc5e0f8e23fc4e46a08cdcf0545daeac13ea3fb31440bf6c9dbcaf3b21ff36e199c2809b581481c54a396a1cabdd9041b08679574c0652c9e7f779764ddc1c7d71417172484a4235b359c3cfacb378038eae009863c1c6de2372fe7da2d7a0edf0b3846e502e6838d40114cc8256e12b87ed7f64c3e62c061691f78edf95fa66dd543ed9bc5247e2284bb652924534f5174c6f3154d6d20680cdfe30850e69b8ca0ea2033c0f469d9fbd276335e8f09ff6d956857b7165a3e784ab546bc47657430b2945f6caaea2a3120bbed8c3fe86ec3143653601f501e371e20e87b9c50bb463ef96b82cd8c3b2f83eae609d144eab539348fda2b034073f50028d86bdc74c2632e837dea6df164d7056dd4351c24ab110523bd3b915e1a88b2904cd270523f5fbce57baa65ad5d4cecf61277be6d60bd84b0d5efb133854beeebddd8eab02d50b777f269cafd281d252a287cf1900cca34a3b6f467a9ac4fb91368b215654404d39b6dae4c4031c79ed977e10d78b64b1790ab1e78e46ae2f20da50cecb31aeab126c42ce65a613bf93df6511d2fed17893013da45b76b028bad191ce0453f63d1783b7555b7a238794b9acfdca945e9a15774719d2dff158b746d8ecf648cda3f67574a9a141bec2951590f1d6ccac76f0208909d25d6381d76457ddbc12d278de02e565559b827bc34949a6b176edc8d65467bb0d5b020628c08e79be7c6d2299d7833e2eb2ecaef13b944b308105e8ab18b205cbd0ddfdf601b7eda3bfa5e4885aee4af2190d31728304337be47ff4d8b7781a5e2aa504e421a401ef9d57bf48f97ec0ce07b556488b0b08c5b701d761844e28508d02759a84e4f09b78105bc74689b5e60677b44feee538344093f4617a76478180b2579aecce5fa9990b00098d8b7731c8b0cbdbfd6b927f51ab06f819be0bb65c1f890c6ffce383136f44c0de437357b53a80d46d4a945db3548ea0d9499678ce78a0296c599aee7d18cdeb43e080eed3f4beda0d270473e3c83266dda27bbf33394da22b0ff6cf2b0b853242676c321e14b5141d984df5098204ccb5d5ebe5239ab200d2b30171c019f005e59a055acb82653c10b12d6f98d2f29d0a3c2626b25e401ab5b2eb8e3caa4adf76c655a8dedb9cd6baff3ddad4030a1a8a50f02e64fb1cb92c490fe8ded415ad04903ccd576953658136f3ad4331a0bceba9b2c80e58b7e4cf49d355ebeae90e3f2a2d3e9efe5953ded5a63a4d8862979aff9f978e91a0b81c15ea5b2a3c614c1c20d01d564e82b8c267b436b572570d68899faf86879f88b98b1795555c22851eb56ddd382e722c943f16e44fb7b97f3024bd0e1bb0ccb6608fa0e99d008e447bbd0e9995476538a87c3126532f91d79c2a6fc69d0314982bdbf236228fdb9ea8ab0821d2f2cc2d083ce1f4a1a39e866fe7c3e3e246ce87a5eb9da0eb469988830a306508ab2f6bacd07d95cf5a2f684cff6de54c2339ac15fca7763d3bc96812b3de67e575f455aaa788b83ab29b6b698099b30c60b3002d97bc50ad4ce10dffefa68cb1e0bf6502d2fa86d5a7aa6914c09d97d05d9114f3fbf4701a65ca77402ad865b4bc49f3791b79545ad49502c144f6fd1c9cf55b0acb7965df3211bd86e5f2b9a4c00424bd5091cfda1f1419c5377ffbc25b33a45dc457528d74bb518b2957a664ddd02a94c251ce962cbda7d34706fbe0aec9f71084db8ef4ab7eff09e60ac485d0ffba9b98c3e17c916208bbc33f8f4cede252060726cb3153391f63135c377768de1204bd5b44e12987f45db46264415cfe3c29ebbff564e5647ccae33e791e621b3cd13a4850f57ae772d21a82ffdda9d49bc547bffbae9c457348cdee40da0bfd46d319708a3e6fa2a60b8d7211a132171f65a076b3c3c0e4ded3d6b2b7c8c174d0997a8cc5d2b21997e2ebd4c92664e091190443bba0c5ac90041a1b69193599a2c5216a8c420d02d4b466508ac3f5d7ffa564a9b6ffa4b30cc817edd5d9b872af5a48a64d68ea4c9b0d761457b4c079316ecd386fa3efcc19a90105d66416c0b5da51719a832e31a6fb3df165fe1cc19f7367173cb87f3bfcd10186a4f93a01a7cdb6be2817574218ffa87d995626891cd086f4ee1ddedd7e298be095decea6a5baba3edb3d8960a1a902c2e2bf16f0989d1b52b0a004aea6aacb929b93b388937b40cf0fac1d6494a187f15a29ea197ccb7123e55183bf6230e0b3174643e17c18f66d122a4073e29eb7948b44efa32922c650931a190e4a5213ae45036d5f205b46951856624654c596b995fe96491abb371b780c6c3a9da11350dd7455d08d62969a1315d02df98f71ff688c52e2af9f6c97a8c80c76148892ce35ffb74b81a72d1de4699a101c8c62caf9368cb9a0471798549a4af74c8ab402c53773267c0469540e164d59e1da4799d533f62ab4b0cfc18cff4da571d0d3a3a622480f3abaedbc71114e82fc41c8ffa241ee950c73461b9e5b2814c9fef26121595b4a466d6155ce0d32f8a3b6a887a2f011730369110ccc4ff9daeccb01a827bf8f41855aefe9e8dc5eab82edb0c672495dab981756cec4bb2a1d6d7aac4c772a29a5b4148f52a077b38b7a256f70ff042996e8843ec29f656460d7f5faef0bf32301a8e67d0b31bda10e6cffb578efa202aa890c1b3bf9fdbbdf1038030fd7f71ad31a55038710f2"})

[  362.447649] binder: undelivered TRANSACTION_ERROR: 29201
[  362.453339] binder: send failed reply for transaction 1239, target dead
03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:16:03 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(r2, 0x200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, 0x0}, @flat=@binder={0x73622a85, 0xde0d1d9b4783b57e, 0x1}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x0, [], [{0xa56, 0x3, 0x2, 0xe4, 0x8, 0x2}, {0x2, 0x9, 0x2, 0x8, 0x7}], [[]]})

[  362.502316] binder: release 15231:15236 transaction 1266 out, still active
[  362.513300] binder: undelivered TRANSACTION_COMPLETE
[  362.529473] binder: BINDER_SET_CONTEXT_MGR already set
03:16:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000140)='system_u:object_r:devlog_t:s0\x00', 0x1e)
syz_emit_ethernet(0xb9, &(0x7f00000001c0)={@random="306c38c0ad40", @dev={[], 0x29}, [], {@llc_tr={0x11, {@snap={0xaa, 0xaa, "9d", "3ef56e", 0x8864, "7ee39afe54be42b81eb3bfea9b4de8505129eab746988cb4411243c0015e163f00bcbb4bfd0747842d0108fe5fee2d5e81e5f3d1d311303758fd5d09d843a27e9ad5dce7dee01eb2ee6f27913a698b0e7ecd2134b8230f6c7ea6bb444f2e368fd2053de51ff0625f77c2e561e18627d57cc440b526ddd37b8a8e7e7aa07960f4c5d6e867e0a122b7d8fc5e292f4ea3704349f9c8936b001164149db77b5e9dcdb39514"}}}}}, &(0x7f0000000100)={0x1, 0x3, [0xe6f, 0x66c, 0xcb5, 0xc36]})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000200000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
syz_open_dev$char_usb(0xc, 0xb4, 0x1)

03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:16:03 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

[  362.529482] binder: 15234:15243 ioctl 40046207 0 returned -16
[  362.551845] binder: BINDER_SET_CONTEXT_MGR already set
03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, 0x0}}], 0x0, 0x0, 0x0})

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='memory.stat\x00', 0x0, 0x0)
ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000140)=""/49)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x338, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  362.551853] binder: 15244:15245 ioctl 40046207 0 returned -16
[  362.563238] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.563257] binder: 15244:15245 transaction failed 29189/-3, size 112-0 line 3284
03:16:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = open(&(0x7f0000000100)='./file0\x00', 0x800, 0x149)
ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000140)=0x8000)

[  362.616969] binder: BINDER_SET_CONTEXT_MGR already set
03:16:03 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

[  362.616977] binder: 15254:15258 ioctl 40046207 0 returned -16
[  362.627488] binder_alloc: 15234: binder_alloc_buf, no vma
[  362.627507] binder: 15254:15258 transaction failed 29189/-3, size 88-24 line 3284
[  362.628977] binder: BINDER_SET_CONTEXT_MGR already set
[  362.628987] binder: 15254:15262 ioctl 40046207 0 returned -16
03:16:03 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180))
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0x279)
ioctl$TUNSETGROUP(r2, 0x400454ce, r3)
r4 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(r2, 0x200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, 0x0}, @flat=@binder={0x73622a85, 0xde0d1d9b4783b57e, 0x1}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x0, [], [{0xa56, 0x3, 0x2, 0xe4, 0x8, 0x2}, {0x2, 0x9, 0x2, 0x8, 0x7}], [[]]})

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
mlockall(0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:03 executing program 5:
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000000))
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00( \x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  362.632969] binder: BINDER_SET_CONTEXT_MGR already set
[  362.632976] binder: 15257:15259 ioctl 40046207 0 returned -16
[  362.633759] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.633774] binder: 15257:15259 transaction failed 29189/-3, size 112-0 line 3284
03:16:03 executing program 1:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r1 = getpid()
fcntl$lock(r0, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r1})
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f00000000c0)={0x8})
r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="002200000000000028000000000000005000102bc6b003c3cb0e6eb425707d39d381000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x60, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x3}, @dead_binder_done, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x48a4bed08f5d4ead, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/4096, 0x1000, 0x2, 0x23}, @fd={0x66642a85, 0x0, r2}}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}, @increfs], 0x0, 0x0, 0x0})
r3 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000001540)={{0xa, 0x4e20, 0x6, @mcast2, 0x57b}, {0xa, 0x4e24, 0x6, @mcast2, 0x7}, 0x0, [0xfffffffc, 0x5e2, 0x40, 0x3, 0x1, 0x3, 0x7, 0x3]}, 0x5c)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r4 = accept4(r3, &(0x7f0000000000)=@sco, &(0x7f00000000c0)=0x80, 0x181000)
sendmsg$nl_xfrm(r4, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000013c0)=ANY=[@ANYBLOB="5c0100001e00200025bd7000fddbdf25e0000002000000000000000000000000000004d60a003c00fe80000000000000000000000000002420000000073500000c000f0000000000000000003c001700080000002cbd700026bd700027bd70002abd700000000000f10f000098c20000b80c1e530104000007000000030000000300000009000000c40005007f000001000000000000000000000000000004d26c0000000a000000ff01000000000000000000000000000101350000010001000200000004000000130d00007f000001000000000000000000000000000004d33300000002000000ffffffff00000000000000000000000000000000040301000000000003000000fbfffffffe80000000000000000000000000001b000004ec470000000a00000000000080000000000000000000000000043580000106200005000000000000800010000010000a002cbd70002cbd7000ff7f0000"], 0x15c}, 0x1, 0x0, 0x0, 0x800}, 0x20000001)

03:16:03 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x84000, &(0x7f0000000140)=ANY=[@ANYBLOB='fn=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d30303030303030303ec8e39cc7dab6be3030303030303030303034303030012c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = pkey_alloc(0x0, 0x6)
pkey_free(r3)
pkey_free(r3)
sendfile(r2, r1, 0x0, 0x8000fffffffe)
ioctl$TCSBRKP(r0, 0x5425, 0x7)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
ioctl$EVIOCGPROP(r4, 0x80404509, &(0x7f0000000340)=""/235)

03:16:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/status\x00', 0x0, 0x0)
r5 = syz_open_dev$rtc(&(0x7f00000007c0)='/dev/rtc#\x00', 0x8, 0x4000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000780)={0xdc, 0x0, &(0x7f0000000600)=[@acquire, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/184, 0xb8, 0x2, 0x3a}, @flat=@handle={0x73682a85, 0x1000, 0x1}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x23, 0x40}}}, @increfs_done={0x40106308, 0x1}, @exit_looper, @exit_looper, @acquire, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/226, 0xe2, 0x2, 0x25}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r5}}, &(0x7f0000000300)={0x0, 0x28, 0x40}}, 0x1060}, @request_death={0x400c630e, 0x1}, @clear_death={0x400c630f, 0x1}], 0x6f, 0x0, &(0x7f0000000700)="b98864fb31d3d408facdbbec9a2fc818674f140029e8381c09dae1ff62ef4c544810aaf1e86bb60fc62c3d61f570bb59765115565119ffdf9bcf62ff1675ea2093ae1833e420541ba578787051fd27d3b74abf67ae1bbba3051df178ede91a02ddaf2d9078289f3b898e84ec3a8d49"})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  362.652137] binder: 15256:15261 got transaction with too large buffer
[  362.652162] binder: 15256:15261 transaction failed 29201/-22, size 120-24 line 3493
[  362.666513] binder: BINDER_SET_CONTEXT_MGR already set
[  362.666523] binder: 15256:15265 ioctl 40046207 0 returned -16
03:16:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@decrefs], 0x0, 0x0, 0x0})

03:16:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
sendmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)}], 0x3}, 0x0)
clone(0x800007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="13d50f34"], 0x4}}, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYPTR, @ANYBLOB="8a7cfcb0bd543a07372504455ddfd0430764ef04ff46cf47e8137f38a3729f9fbaa545c0c343d9b3bec2feff1f63caf2a574caec1cfb03919139aa1800"/75], 0x0, 0x4a}, 0x20)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
fsync(r2)
tkill(r1, 0x3b)
ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r1, 0x0, 0x0)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
ioctl$RTC_SET_TIME(r5, 0x4024700a, &(0x7f0000000300)={0x1e, 0x29, 0x11, 0x13, 0x1, 0x2, 0x3, 0x9c, 0x1})
socketpair(0x2, 0xa, 0x1, &(0x7f0000000100)={<r8=>0xffffffffffffffff})
bind$netlink(r3, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfe, 0xadeacaa162b1d0e2}, 0xc)
r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00')
sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0003a123640de6f92fecc754daf74c", @ANYRES16=r9, @ANYBLOB="08002dbd7000fcdbdf250e0000000800060007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x80)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r10 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
pipe(&(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  362.666880] binder_alloc: 15256: binder_alloc_buf, no vma
[  362.666897] binder: 15256:15265 transaction failed 29189/-3, size 120-24 line 3284
[  362.695286] binder: BINDER_SET_CONTEXT_MGR already set
[  362.695294] binder: 15266:15269 ioctl 40046207 0 returned -16
[  362.695515] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.695531] binder: 15266:15269 transaction failed 29189/-3, size 112-0 line 3284
[  362.704434] binder: BINDER_SET_CONTEXT_MGR already set
[  362.704441] binder: 15267:15270 ioctl 40046207 0 returned -16
[  362.704893] binder_alloc: 15234: binder_alloc_buf, no vma
[  362.704908] binder: 15267:15270 transaction failed 29189/-3, size 120-24 line 3284
[  362.714070] binder: BINDER_SET_CONTEXT_MGR already set
[  362.714077] binder: 15267:15270 ioctl 40046207 0 returned -16
[  362.728020] binder: BINDER_SET_CONTEXT_MGR already set
[  362.728029] binder: 15272:15274 ioctl 40046207 0 returned -16
[  362.728815] binder_alloc: 15256: binder_alloc_buf, no vma
[  362.728831] binder: 15272:15274 transaction failed 29189/-3, size 120-24 line 3284
[  362.736203] binder: BINDER_SET_CONTEXT_MGR already set
[  362.736212] binder: 15272:15276 ioctl 40046207 0 returned -16
[  362.736616] binder_alloc: 15256: binder_alloc_buf, no vma
[  362.736633] binder: 15272:15274 transaction failed 29189/-3, size 120-24 line 3284
[  362.850785] binder: BINDER_SET_CONTEXT_MGR already set
[  362.850794] binder: 15283:15289 ioctl 40046207 0 returned -16
[  362.850909] binder: BINDER_SET_CONTEXT_MGR already set
[  362.850915] binder: 15284:15290 ioctl 40046207 0 returned -16
[  362.851176] binder_alloc: 15234: binder_alloc_buf, no vma
[  362.851195] binder: 15284:15290 transaction failed 29189/-3, size 120-24 line 3284
[  362.853193] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.853212] binder: 15283:15289 transaction failed 29189/-3, size 88-24 line 3284
[  362.869406] binder: BINDER_SET_CONTEXT_MGR already set
[  362.869414] binder: 15284:15290 ioctl 40046207 0 returned -16
[  362.874699] binder: BINDER_SET_CONTEXT_MGR already set
[  362.874707] binder: 15285:15288 ioctl 40046207 0 returned -16
[  362.876461] binder_alloc: 15256: binder_alloc_buf, no vma
[  362.876480] binder: 15285:15288 transaction failed 29189/-3, size 120-24 line 3284
[  362.884372] binder: BINDER_SET_CONTEXT_MGR already set
[  362.884380] binder: 15285:15288 ioctl 40046207 0 returned -16
[  362.884999] binder_alloc: 15256: binder_alloc_buf, no vma
[  362.885016] binder: 15285:15288 transaction failed 29189/-3, size 120-24 line 3284
[  362.927840] binder: BINDER_SET_CONTEXT_MGR already set
[  362.927848] binder: 15293:15299 ioctl 40046207 0 returned -16
[  362.928080] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.928098] binder: 15293:15299 transaction failed 29189/-3, size 120-24 line 3284
[  362.935373] binder: BINDER_SET_CONTEXT_MGR already set
[  362.935382] binder: 15297:15304 ioctl 40046207 0 returned -16
[  362.935833] binder: 15297:15304 DecRefs 0 refcount change on invalid ref 3 ret -22
[  362.935840] binder: 15297:15304 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  362.935847] binder: 15297:15304 got transaction to invalid handle
[  362.935855] binder: 15297:15304 transaction failed 29201/-22, size 88-24 line 3138
[  362.937612] binder: BINDER_SET_CONTEXT_MGR already set
[  362.937620] binder: 15293:15306 ioctl 40046207 0 returned -16
[  362.937823] binder_alloc: 15231: binder_alloc_buf, no vma
[  362.937840] binder: 15293:15306 transaction failed 29189/-3, size 120-24 line 3284
[  362.937922] binder: BINDER_SET_CONTEXT_MGR already set
[  362.937929] binder: 15302:15305 ioctl 40046207 0 returned -16
[  362.943726] binder: BINDER_SET_CONTEXT_MGR already set
[  362.943734] binder: 15297:15308 ioctl 40046207 0 returned -16
[  362.946506] binder: 15297:15308 DecRefs 0 refcount change on invalid ref 3 ret -22
[  362.946512] binder: 15297:15308 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  362.946519] binder: 15297:15308 got transaction to invalid handle
[  362.946530] binder: 15297:15308 transaction failed 29201/-22, size 88-24 line 3138
[  362.957177] binder: BINDER_SET_CONTEXT_MGR already set
[  362.957185] binder: 15302:15309 ioctl 40046207 0 returned -16
[  363.007993] binder: BINDER_SET_CONTEXT_MGR already set
[  363.008002] binder: 15317:15321 ioctl 40046207 0 returned -16
[  363.011148] binder: BINDER_SET_CONTEXT_MGR already set
[  363.011155] binder: 15313:15320 ioctl 40046207 0 returned -16
[  363.011355] binder: 15313:15320 DecRefs 0 refcount change on invalid ref 0 ret -22
[  363.011361] binder: 15313:15320 unknown command 0
[  363.011367] binder: 15313:15320 ioctl c0306201 20000180 returned -22
[  363.014573] binder_alloc: 15234: binder_alloc_buf, no vma
[  363.014591] binder: 15317:15321 transaction failed 29189/-3, size 120-24 line 3284
[  363.019571] binder: BINDER_SET_CONTEXT_MGR already set
[  363.019581] binder: 15313:15323 ioctl 40046207 0 returned -16
[  363.019781] binder: 15313:15323 DecRefs 0 refcount change on invalid ref 0 ret -22
[  363.019787] binder: 15313:15323 unknown command 0
[  363.019796] binder: 15313:15323 ioctl c0306201 20000180 returned -22
[  363.025014] binder: BINDER_SET_CONTEXT_MGR already set
[  363.025021] binder: 15317:15324 ioctl 40046207 0 returned -16
[  363.029050] binder_alloc: 15234: binder_alloc_buf, no vma
[  363.029066] binder: 15317:15324 transaction failed 29189/-3, size 120-24 line 3284
[  363.092305] binder: BINDER_SET_CONTEXT_MGR already set
[  363.092312] binder: 15315:15322 ioctl 40046207 0 returned -16
[  363.092589] binder_alloc: 15256: binder_alloc_buf, no vma
[  363.092605] binder: 15322:15322 transaction failed 29189/-3, size 120-24 line 3284
[  363.206102] binder: BINDER_SET_CONTEXT_MGR already set
[  363.206110] binder: 15322:15330 ioctl 40046207 0 returned -16
[  363.206299] binder_alloc: 15256: binder_alloc_buf, no vma
[  363.206315] binder: 15322:15330 transaction failed 29189/-3, size 120-24 line 3284
[  363.567607] binder: undelivered TRANSACTION_ERROR: 29189
[  363.573049] binder: undelivered TRANSACTION_ERROR: 29189
[  363.578552] binder: undelivered TRANSACTION_ERROR: 29189
[  363.584213] binder: undelivered TRANSACTION_ERROR: 29189
[  363.589933] binder: undelivered TRANSACTION_ERROR: 29201
[  363.595548] binder: undelivered TRANSACTION_ERROR: 29189
[  363.601166] binder: undelivered TRANSACTION_ERROR: 29201
[  363.606730] binder: undelivered TRANSACTION_ERROR: 29189
[  363.612369] binder: undelivered TRANSACTION_ERROR: 29189
[  363.617973] binder: undelivered TRANSACTION_ERROR: 29189
[  363.623531] binder: undelivered TRANSACTION_ERROR: 29189
[  363.629191] binder: undelivered TRANSACTION_ERROR: 29189
[  363.634825] binder: undelivered TRANSACTION_ERROR: 29189
[  363.640370] binder: undelivered TRANSACTION_ERROR: 29189
[  363.646021] binder: undelivered TRANSACTION_ERROR: 29189
[  363.651660] binder: undelivered TRANSACTION_ERROR: 29189
03:16:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:04 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x100000, &(0x7f0000000280)=ANY=[@ANYBLOB="66bd00", @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000\b\x00\x00\x00000000040000,user_id=', @ANYRESDEC=0x0, @ANYRES16=r0, @ANYRESDEC=0x0])
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:04 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev\xb3\xb8\xcfU(Q\xc9)\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYBLOB="bdd327afb197f6187f6e7d3e0ce0f6d82b5c0907a9832bbdda72ab7fb0f08dfdc69708a43f79a5211b24ad98c475067906c08ad191b646c6953b031b75e6ce11fe9a91bc3721f354b5023a96a2f82828e34ab357df6f15970e409a1d546930322aa3042dd33d217ef82da3f133482b8fa0dd0391c97bce8da4cbfa1c2cc41ed83962d2a279b8b6800203ef4234168d043e476dbb9aee9c392437d4f21f89225d6b86c2521de01c152101c792bcef45e762fa891ab49ebd507382d2266cc02e647b4074faa2ef9e502d377f9701921a80a96cc877d34ceae2189b0513306e4755638b9df22e69c7f874dcf14a4c07e78a", @ANYRES64=r4, @ANYBLOB="4bc0210c40264b73455a98592a5c1cc77d1f7fa8ad6d185fb83c83a9f230a39d20f2a17960739e02cc04facb3bd027effbe66006558ba7a790f30ff1b716409588ab0b952de1a0d9eea9b2eee4ad", @ANYRES64=r1, @ANYRESOCT, @ANYRES32=r1], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRES64], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB="791885f6730ea1e79c5962"], 0x0, 0x0, 0x0})

03:16:04 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

03:16:04 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x54)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  363.657280] binder: undelivered TRANSACTION_ERROR: 29189
[  363.662837] binder: undelivered TRANSACTION_ERROR: 29201
[  363.668509] binder: undelivered TRANSACTION_ERROR: 29189
[  363.674062] binder: undelivered TRANSACTION_ERROR: 29189
[  363.679706] binder: undelivered TRANSACTION_ERROR: 29189
[  363.685485] binder: send failed reply for transaction 1266, target dead
03:16:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
preadv(r2, &(0x7f0000000240)=[{&(0x7f0000000100)=""/6, 0x6}, {&(0x7f00000001c0)=""/91, 0x5b}, {&(0x7f0000000140)=""/29, 0x1d}, {&(0x7f00000003c0)=""/4096, 0x1000}], 0x4, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  363.708199] binder: 15334:15338 unknown command 0
[  363.713877] binder: 15334:15338 ioctl c0306201 20000100 returned -22
03:16:04 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000400)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000500)=0xe8)
sendmsg$nl_route(r4, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2008}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000005e0000002abd7000ffdbdf2500000000", @ANYRES32=r6, @ANYBLOB="03000040"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x996a14396418f24f)
openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0)
read$char_usb(r3, 0x0, 0x0)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r8)
r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r10 = getpid()
fcntl$lock(r9, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r10})
r11 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r11, 0x4024700a, 0x0)
preadv(r11, &(0x7f00000017c0), 0x1fe, 0x500)
perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x6, 0x1f, 0x6, 0x3f, 0x0, 0x3, 0x8004, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x2, @perf_config_ext={0x3, 0x10000}, 0x409, 0x4, 0x9, 0x6, 0x8, 0x991, 0x401}, r10, 0x7, r11, 0x2)
ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000100)=0x8000)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:04 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x2)
fsetxattr$security_ima(r2, &(0x7f0000000080)='security.ima\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="021db6078d61a39aa40d4e5a0ab948c263427b8b284a519d0adf3573e8040b45cedc4b88ea778b891bb07e8c208ec95b09d8d4f589452809155927dc37a345aa8e25ef3093a8fdc57034143c83fc25a058a5675e960a6929450b4259fcd042e858a263c4f5d78b6c318c3a3ae8967e0a619fb479e68b8a130953e5f27dd33af742b8eda6788e5ad1ec0c815ddad4a7f273fa4086eaa729eef79001667a4e8b969ab72d7d0f3c33d6af69db6b2e89e2fc795f9879781354ff6af4b27586e337fb"], 0x4, 0x2)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
fallocate(r4, 0x6, 0x2, 0x940)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
sendfile(r3, r1, 0x0, 0x8000fffffffe)

03:16:04 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

[  363.793083] binder: 15351:15352 not enough space to store 0 fds in buffer
[  363.818230] binder: 15351:15352 transaction failed 29201/-22, size 120-24 line 3475
03:16:04 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

[  363.840071] binder_alloc: 15353: binder_alloc_buf, no vma
[  363.840089] binder: 15353:15356 transaction failed 29189/-3, size 120-24 line 3284
[  363.840313] binder: undelivered TRANSACTION_ERROR: 29189
[  363.880362] binder: undelivered TRANSACTION_ERROR: 29201
[  363.887788] binder: 15351:15365 not enough space to store 0 fds in buffer
[  363.898274] binder: 15351:15365 transaction failed 29201/-22, size 120-24 line 3475
[  363.906573] binder: undelivered TRANSACTION_ERROR: 29201
03:16:06 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2067726f75705f69643dc2b7f49ce0789cf88c4eb6e336e42bbf029889cd1a5451310ac0ed0d1fec19c0594331a17eb8718e4b93aff08a2f", @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:06 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = getpid()
fcntl$lock(r1, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r2})
ptrace$peekuser(0x3, r2, 0x1)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="110000000000000000000000000000000000000000000000000000000000000078000000000000000000000051481b0b1c264b4e5fcb4c0296b8bcc21f9fd0aa97a365c8ac38a0cedf0b6e47a767a8fc9afb8b95", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000280000000000000050000000000000000c4b9e546e7022571876dc99b345ddad3bf584d0222c6a9ee41e3cec2204a791b565793c1adc614a6202eb193f24e93242dec637f031bb622129aef073bd19ec9b5ba3d65db0181b27b3719469ce9c572d95bf2b9f8aefb45fafcde965f2607a51e6b5033931442278709fd3f5eae6c468ac134221b8d8b04b9baae31b1b8a451268e2666a52fba62e1c957da00872a993b327fc0a770a62975c0e5beb2cd077f38cf350e65c8645b45a8baa3e3d99c7263ad50a179de402fb2b60102b4912c059ef9b55551d839d9023cc01bd4d071073d2db8bf4ce000000000000000000"], @ANYBLOB="e1ffffffffff0400"], 0x0, 0x0, 0x0})

03:16:06 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
r5 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r6 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r5, r6)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x7, 0xfff}, @mss={0x2, 0x1c81}, @window={0x3, 0x1, 0xffdd}, @mss={0x2, 0x3}], 0x4)
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
ioctl$sock_SIOCBRDELBR(r7, 0x89a1, &(0x7f0000000040)='ip6tnl0\x00')
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000000)=[@clear_death={0x400c630f, 0x2}], 0x4bd3d76c2cba9117, 0x0, 0x0})

03:16:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:06 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:06 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x17}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  366.006281] binder: 15374:15378 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  366.020490] binder: 15373:15382 unknown command 17
[  366.028130] binder: 15374:15378 ioctl c0306201 20000180 returned -14
03:16:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
socket$inet6_tcp(0xa, 0x1, 0x0)

03:16:06 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
syncfs(r0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r3, r2, 0x0, 0x8000fffffffe)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000080)=0x1, 0x4)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r7)
write$FUSE_POLL(r4, &(0x7f0000000040)={0x18, 0xfffffffffffffffe, 0x3}, 0x18)

[  366.031895] binder: 15383:15384 not enough space to store 0 fds in buffer
[  366.031918] binder: 15383:15384 transaction failed 29201/-22, size 120-24 line 3475
03:16:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f00000001c0)="d33904e4e49044ca39a6be19dd9fea9cede37abfa14bcd3a35e1e2acec2b0cc65a947aa41ae1278f9a808717be695b9399ea57efb7dba05ad9bf400f9af675d3aa41f89a05eb9a191131a1cbe679e8a1aae201bafceafa85316fc445b8ac36de8b08326682f6a2814eadae47edc21debc5b3318ba96abaa5fe5b6117618795e78512be34df0e786d6d83149b7696c375c194a5726f8488c74737b8d9a67469b477d54fb3fd2f6f1b81dc2d4085d50c9940f1038336363abf6b")
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x100, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x367}}}], 0x0, 0x0, 0x0})

03:16:06 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
write$selinux_user(r1, &(0x7f0000000140)={'system_u:object_r:ppp_device_t:s0', 0x20, 'system_u\x00'}, 0x2b)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  366.032046] binder: undelivered TRANSACTION_ERROR: 29201
[  366.044579] binder: 15383:15387 not enough space to store 0 fds in buffer
[  366.044608] binder: 15383:15387 transaction failed 29201/-22, size 120-24 line 3475
[  366.044925] binder: undelivered TRANSACTION_ERROR: 29201
[  366.099206] binder_alloc: 15390: binder_alloc_buf, no vma
[  366.099224] binder: 15390:15397 transaction failed 29189/-3, size 112-24 line 3284
[  366.099948] binder: undelivered TRANSACTION_ERROR: 29189
[  366.115535] binder: 15395:15401 not enough space to store 0 fds in buffer
[  366.115564] binder: 15395:15401 transaction failed 29201/-22, size 120-24 line 3475
[  366.115952] binder: undelivered TRANSACTION_ERROR: 29201
[  366.124807] binder: 15395:15402 not enough space to store 0 fds in buffer
[  366.124833] binder: 15395:15402 transaction failed 29201/-22, size 120-24 line 3475
[  366.125255] binder: undelivered TRANSACTION_ERROR: 29201
[  366.171706] binder: 15403:15405 got transaction with invalid offset (871, min 80 max 112) or object.
[  366.171733] binder: 15403:15405 transaction failed 29201/-22, size 112-24 line 3379
[  366.171870] binder: undelivered TRANSACTION_ERROR: 29201
[  366.212314] binder: 15408:15410 not enough space to store 0 fds in buffer
[  366.212339] binder: 15408:15410 transaction failed 29201/-22, size 120-24 line 3475
[  366.212475] binder: undelivered TRANSACTION_ERROR: 29201
03:16:07 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000040)=0x1)

[  366.233511] binder: 15408:15412 not enough space to store 0 fds in buffer
[  366.233537] binder: 15408:15412 transaction failed 29201/-22, size 120-24 line 3475
[  366.234592] binder: undelivered TRANSACTION_ERROR: 29201
[  366.341252] binder: 15373:15382 ioctl c0306201 20000180 returned -22
[  366.352914] binder: 15373:15419 unknown command 17
[  366.358011] binder: 15373:15419 ioctl c0306201 20000180 returned -22
03:16:09 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = fcntl$dupfd(r1, 0x406, 0xffffffffffffffff)
write$P9_RFLUSH(r2, &(0x7f0000000100)={0x7, 0x6d, 0x1}, 0x7)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x20080, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:09 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
write$FUSE_LSEEK(r1, &(0x7f0000000000)={0x18, 0x0, 0x4}, 0x18)

03:16:09 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x8000, 0x40)
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
fcntl$dupfd(r5, 0x0, r6)
ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000140))
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
write$P9_RRENAME(r1, &(0x7f0000000100)={0x7, 0x15, 0x1}, 0x7)
r7 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:09 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x800, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000040)={0x6, 0x2})
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r5, r1, 0x0, 0x8000fffffffe)

03:16:09 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = getpid()
fcntl$lock(r3, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r4})
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, &(0x7f0000000100), 0x18)
listen(r3, 0x200)
r6 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
socket$nl_route(0x10, 0x3, 0x0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r7 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, &(0x7f0000000040))
ptrace$setopts(0x4206, r7, 0x0, 0x0)
tkill(r7, 0x1e)
ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428)
wait4(0x0, 0x0, 0x0, 0x0)
write$input_event(r6, &(0x7f0000000000)={{}, 0x5, 0x400, 0x2}, 0x18)

03:16:09 executing program 2:
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  369.006615] binder: 15428:15430 not enough space to store 0 fds in buffer
[  369.014426] binder: 15428:15430 transaction failed 29201/-22, size 120-24 line 3475
[  369.023698] binder: undelivered TRANSACTION_ERROR: 29201
[  369.037996] binder: 15427:15436 got transaction with fd, 6, but target does not allow fds
03:16:09 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = open(&(0x7f0000000100)='./file0\x00', 0x40000, 0x140)
ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f00000001c0))
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:09 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
getsockopt(r1, 0xe3b0, 0xd7a6, &(0x7f00000001c0)=""/130, &(0x7f0000000100)=0x82)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x1, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
lstat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
fchown(r2, r4, r7)

[  369.059106] binder: 15427:15436 transaction failed 29201/-1, size 104-24 line 3427
[  369.070074] binder: undelivered TRANSACTION_ERROR: 29201
03:16:09 executing program 2:
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:09 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
listen(r5, 0x200)
r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r8 = getpid()
fcntl$lock(r7, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r8})
listen(r7, 0x200)
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r9, 0x0, 0x0)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r9, 0x400454ce, r11)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="444d47e931f10baffeb5afe95515cc2abacea0452e8d2ae9cec97f4c42f1b276fd287172a108540aaf8289b3e196a1fa01320edd96f5c89829a5acc07064ae2df12bb2a8727c3d2df89980b108237d2c9d2b116d3513256929155eaf82be490772568f8199de8f8eea38fc28614e1825725c5b18d310e260e453df79f5e6e55fcd9ee2ea0e71b70b5727f415fbef6546f884f870dcd4c73c919f19c6", @ANYRESHEX=0x0, @ANYPTR, @ANYRES16=r3, @ANYPTR], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="d5ed5462c9ca573cb22ff7f3efa5b445f78b2b94e6ad749089fbed9426f17c68e45be51388735111539b6185237b4309db7a0ad3d4bd6aaf70652a1fbb97f070c43a8d428d6cac1a05c51c2bf56c773c059044dd57b712e33fed940e8e77d7908d226870b3bee769efda0d001227ec008326853858c3b770b99757f72d9a91096faa", @ANYRES32=0x0, @ANYRESOCT=r5, @ANYRES16=r7, @ANYRESOCT=r0], @ANYRES32=r9, @ANYRES16=r0], @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  369.120903] binder: 15447:15449 not enough space to store 0 fds in buffer
[  369.148580] binder: 15447:15449 transaction failed 29201/-22, size 120-24 line 3475
03:16:09 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x639f}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:09 executing program 2:
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={<r3=>0x0}, &(0x7f0000000140)=0xc)
r4 = socket$inet(0x2, 0x2268499fca6878c2, 0x4)
fcntl$setown(r1, 0x8, r3)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
getsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000240)={@initdev, @rand_addr, @multicast2}, &(0x7f0000000280)=0xc)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  369.151086] binder: 15448:15453 got transaction with invalid parent offset or type
03:16:09 executing program 2:
creat(0x0, 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:09 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="fde300ffffff6f4591730b6038ffff"], 0x0, 0x0, 0x0})

[  369.151107] binder: 15448:15453 transaction failed 29201/-22, size 112-24 line 3525
[  369.151297] binder: undelivered TRANSACTION_ERROR: 29201
[  369.158668] binder: 15450:15455 not enough space to store 0 fds in buffer
[  369.159109] binder: 15450:15455 transaction failed 29201/-22, size 120-24 line 3475
[  369.161975] binder: undelivered TRANSACTION_ERROR: 29201
[  369.168476] binder: 15450:15460 not enough space to store 0 fds in buffer
[  369.168502] binder: 15450:15460 transaction failed 29201/-22, size 120-24 line 3475
[  369.179053] binder: undelivered TRANSACTION_ERROR: 29201
[  369.217599] binder: 15463:15469 got transaction with too large buffer
[  369.217624] binder: 15463:15469 transaction failed 29201/-22, size 120-24 line 3493
[  369.217741] binder: undelivered TRANSACTION_ERROR: 29201
[  369.223689] binder: 15463:15471 got transaction with too large buffer
[  369.223712] binder: 15463:15471 transaction failed 29201/-22, size 120-24 line 3493
[  369.223915] binder: undelivered TRANSACTION_ERROR: 29201
[  369.235507] binder: 15468:15470 not enough space to store 0 fds in buffer
[  369.235531] binder: 15468:15470 transaction failed 29201/-22, size 120-24 line 3475
[  369.235764] binder: undelivered TRANSACTION_ERROR: 29201
[  369.299141] binder_alloc: 15475: binder_alloc_buf size 5003499185991902352 failed, no address space
[  369.299148] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  369.299166] binder: 15475:15478 transaction failed 29201/-28, size 120-24 line 3284
[  369.299305] binder: undelivered TRANSACTION_ERROR: 29201
[  369.300218] binder_alloc: 15475: binder_alloc_buf size 5003499185991902352 failed, no address space
[  369.300226] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  369.300245] binder: 15475:15480 transaction failed 29201/-28, size 120-24 line 3284
[  369.300460] binder: undelivered TRANSACTION_ERROR: 29201
[  369.460829] binder: undelivered TRANSACTION_ERROR: 29201
03:16:12 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000100)={0x0, 0x7, 0x4, 0x6, 0x5, 0x20, 0x31, 0x7, 0x8eae, 0x8})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r5=>0xffffffffffffffff})
r6 = dup2(r5, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r7 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r7, 0x0, 0x0)
r8 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$BLKGETSIZE64(r8, 0x80081272, &(0x7f0000000040))
tkill(r7, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:12 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
getresgid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f00000001c0))
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
setgid(r6)
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
r9 = dup2(r7, r8)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'veth0_to_team\x00', 0x200})
r10 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r11 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r11, 0x0, 0x0)
r12 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r13=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r11, 0x400454ce, r13)
ioctl$TCFLSH(r11, 0x540b, 0x6ec3caeb)
setsockopt$IP_VS_SO_SET_EDIT(r9, 0x0, 0x483, &(0x7f0000000280)={0x4, @rand_addr=0xffffffff, 0x4e21, 0x4, 'nq\x00', 0xc, 0x7, 0x3b}, 0x2c)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000002000000000000000000000000000000000000000000ffff00000000007800000000a0a70018000000f0ffffff", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="e000000000000000"], 0x0, 0x0, 0x0})

03:16:12 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = accept4$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @broadcast}, &(0x7f0000000140)=0x10, 0x80800)
setsockopt(r2, 0x8, 0x6, &(0x7f00000001c0)="238af7dc96d29b6a26301065b57b4bb1813e82c0a61ca0ede9a7e695cf5e68ada9e7dd280a30201aeb8c525f536faaa5b89f98da9252631c49b433c0b0a164396180d34b73e806e7392ef24f00934aeb8f65fc574d19c194bf5e473ab051e5fcd75e1860fa70a0e5b363e2810e065d894c06945326d042156a55036e92c9e93e08d177ce23366c63c74d540a14ac4bbb60019c76452db68bd7b84be469c0ae", 0x9f)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB="852a747000000019be5014c262d4870004000000000000ad0200000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000040000000000000008561646600400000000000000000000001000000000000001400000000000000ca31191fd48da4422524f6d3405dd1ab21752b5c198cfe8c9e06000ed8d5e61a7d88b143288d8efdb7649fbd7427661f53ac2f2fe969a14adabccbdb071338eaf9cd16f886fb163b38c3055a0458ce85bf09c9c82fc82e"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:12 executing program 0:
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r1)
r2 = geteuid()
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r4)
chown(&(0x7f0000000000)='./file0\x00', r2, r4)
setfsuid(r2)
r5 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r5)
r6 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r6)
keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r5, r6}, &(0x7f0000000140)=""/16, 0x10, &(0x7f00000001c0)={&(0x7f0000000180)={'sha3-256-generic\x00'}})
fsetxattr$trusted_overlay_upper(r3, &(0x7f0000000340)='trusted.overlay.upper\x00', &(0x7f0000000380)={0x0, 0xfb, 0x15, 0x5, 0x7, "c0e7630b6aa053c53fe0ea2171844977"}, 0x15, 0x0)
r7 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
open(&(0x7f0000000040)='./bus\x00', 0x44100, 0x1)
sendfile(r8, r7, 0x0, 0x8000fffffffe)

03:16:12 executing program 2:
creat(0x0, 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:12 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = dup(r2)
ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000100))

03:16:12 executing program 2:
creat(0x0, 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:12 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_policy(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000100))
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  372.064278] binder: 15489:15493 not enough space to store 0 fds in buffer
[  372.075812] binder: 15489:15493 transaction failed 29201/-22, size 120-24 line 3475
[  372.085944] binder: 15488:15498 got transaction with too large buffer
03:16:12 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030303030343030302516757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = open(&(0x7f0000000040)='./bus\x00', 0x101000, 0x988976a7c02e180b)
write$P9_RRENAMEAT(r3, &(0x7f0000000080)={0x7, 0x4b, 0x2}, 0x7)
sendfile(r0, r1, 0x0, 0x8000fffffffe)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r6 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r5, r6)
write$binfmt_script(r5, &(0x7f0000000380)={'#! ', './file1', [{0x20, 'cgroup[userselinux#'}, {0x20, '.['}, {0x20, '/selinux/enforce\x00'}, {0x20, 'net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'}, {0x20, 'vboxnet0keyringmd5sum'}, {0x20, 'selinux-systemvboxnet1*GPL'}, {0x20, 'cpusetmime_type@'}], 0xa, "011a85347c99aa4f3b89896bc0fc07390ac7259376d2f8b42e2b068ab8b359c3c2142a89b8edf0363fbf2eaf24"}, 0x14b)
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
read$char_usb(r7, &(0x7f0000000500)=""/60, 0x3c)
r10 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/status\x00', 0x0, 0x0)
r11 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r11, 0x4024700a, 0x0)
preadv(r11, &(0x7f00000017c0), 0x1fe, 0x500)
r12 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r12, 0x4024700a, 0x0)
preadv(r12, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$RTC_SET_TIME(r12, 0x4024700a, 0x0)
preadv(r10, &(0x7f00000017c0), 0x1fe, 0x500)
sendto$inet(r10, &(0x7f0000000180)="e8b253217bfbbef4b9ad594fb0cee25687e4150afac3aee1026f39b58105297d95b25b7bbc6264e9d4d447133fb26b0895d135f7c2aaad30ff3a8a17e0fdd8a994097f49abb3bba7ea52c1be7733dc07747f936da593e50f72d3", 0x5a, 0x5066b05208221842, &(0x7f0000000340)={0x2, 0x4e24, @broadcast}, 0x10)
r13 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r14=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r14)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000140)=0x2)

[  372.085970] binder: 15488:15498 transaction failed 29201/-22, size 120-24 line 3493
[  372.086113] binder: undelivered TRANSACTION_ERROR: 29201
[  372.098473] binder: 15488:15503 got transaction with too large buffer
[  372.098500] binder: 15488:15503 transaction failed 29201/-22, size 120-24 line 3493
03:16:12 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(0x0, 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:12 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
syz_open_pts(r1, 0x50f181)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
getsockopt$inet6_int(r1, 0x29, 0x12, &(0x7f0000000100), &(0x7f0000000140)=0x4)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  372.098762] binder: undelivered TRANSACTION_ERROR: 29201
[  372.170377] binder: undelivered TRANSACTION_ERROR: 29201
[  372.172403] binder: 15512:15519 not enough space to store 0 fds in buffer
03:16:12 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r3 = fcntl$dupfd(r1, 0x406, r2)
bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfc, 0x2004004}, 0xc)

[  372.172427] binder: 15512:15519 transaction failed 29201/-22, size 120-24 line 3475
[  372.183196] binder: BINDER_SET_CONTEXT_MGR already set
[  372.183206] binder: 15489:15508 ioctl 40046207 0 returned -16
[  372.190069] binder: BINDER_SET_CONTEXT_MGR already set
[  372.190077] binder: 15512:15523 ioctl 40046207 0 returned -16
[  372.190903] binder_alloc: 15512: binder_alloc_buf, no vma
[  372.190919] binder: 15512:15523 transaction failed 29189/-3, size 120-24 line 3284
[  372.267748] binder: BINDER_SET_CONTEXT_MGR already set
[  372.267756] binder: 15530:15532 ioctl 40046207 0 returned -16
[  372.268033] binder_alloc: 15489: binder_alloc_buf, no vma
[  372.268050] binder: 15530:15532 transaction failed 29189/-3, size 120-24 line 3284
[  372.269313] binder: BINDER_SET_CONTEXT_MGR already set
[  372.269321] binder: 15531:15533 ioctl 40046207 0 returned -16
[  372.269564] binder_alloc: 15512: binder_alloc_buf, no vma
[  372.269580] binder: 15531:15533 transaction failed 29189/-3, size 120-24 line 3284
[  372.280475] binder: BINDER_SET_CONTEXT_MGR already set
[  372.280484] binder: 15531:15535 ioctl 40046207 0 returned -16
[  372.280757] binder_alloc: 15512: binder_alloc_buf, no vma
[  372.280775] binder: 15531:15535 transaction failed 29189/-3, size 120-24 line 3284
[  372.285270] binder: BINDER_SET_CONTEXT_MGR already set
[  372.285279] binder: 15530:15536 ioctl 40046207 0 returned -16
[  372.396562] binder: undelivered TRANSACTION_ERROR: 29189
[  372.402741] binder: undelivered TRANSACTION_ERROR: 29189
03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{0x6, 0x7f8, 0x98c0, 0x200}, 'syz0\x00', 0x15})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000002800000000000000500000000000000037cc450940fccfaa18ebbe40ee8466eeb698194eebc03030db23dccdc00c461f10487d6466dd850b3f2cb23f8ffd265d301747ace13bd61ad8ac670bef04f5fc859c3792f423f3ba074410d81a66cc1afa8d0144387ff40a"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000000), 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
truncate(&(0x7f0000000100)='./file0\x00', 0x2)
syz_open_dev$binderN(0x0, 0x0, 0x0)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:13 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = dup2(0xffffffffffffffff, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@sack_perm], 0x1)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r2 = fcntl$dupfd(r1, 0x0, r0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6}, 0x0, @in6=@empty}}, &(0x7f0000000100)=0xe8)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
r7 = geteuid()
r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r9)
chown(&(0x7f0000000000)='./file0\x00', r7, r9)
write$P9_RSTATu(r2, &(0x7f00000002c0)={0x79, 0x7d, 0x2, {{0x0, 0x57, 0x7ff, 0x0, {0x20, 0x2, 0x2}, 0x8000000, 0x3, 0x1, 0x8001, 0x6, 'cgroup', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00', 0x4, 'self'}, 0xd, '/dev/binder#\x00', r3, r6, r7}}, 0x79)
r10 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(0x0, 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  372.410411] binder: undelivered TRANSACTION_ERROR: 29189
[  372.416172] binder: undelivered TRANSACTION_ERROR: 29189
[  372.422208] binder: undelivered TRANSACTION_ERROR: 29201
03:16:13 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c4f6f6f746d6f64653d604dab49303032302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
r6 = geteuid()
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r8)
chown(&(0x7f0000000000)='./file0\x00', r6, r8)
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r9, 0x0, 0x0)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r9, 0x400454ce, r11)
write$FUSE_ENTRY(r3, &(0x7f0000000140)={0x90, 0x0, 0x8, {0x0, 0x1, 0x3, 0x0, 0xfffffffc, 0x2, {0x2, 0x295c, 0x3, 0x1f, 0x6, 0x2, 0x44b, 0x401, 0xfffffff9, 0x1, 0x1, r6, r11, 0x400, 0x4}}}, 0x90)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x132)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'ip6gre0\x00', 0x10})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="000d95da000000000000500000000000743ecedb4aa9ab660020f1569a68350a1cabee09714ed378e6c45cfa93654266d17a7493699a9d3220e5bea8bf10cf69a6f82564696a260f3c8f7a5442c5bb2092997203425a2b02cee7f2e0adf50df68feb7a0e89be93ec16b278f27fe53d051cca7c1de1f7fea9422636d5283aa09bd4973b75d9fafbb37afc114e27c47c3bc1fa66c157f537d914e8458e53a08f122852e261f99403a52a1b4b6405cb3190cecdbbe7909b1fe4da1d6262adfff09d5e462d8a2659df4dca072f42d50e6da614b457604f48a2148f806f17db63d7c217"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x3, 0x9, 0x7})

03:16:13 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00')
sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x401004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r5, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_AF={0x8, 0x2, 0x6f487be30fe5a642}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x67c9}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10)
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x40)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x4)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(0x0, 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400976a9fd4831345f2e8c49700000000000000005000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  372.481899] binder: 15546:15550 ioctl 405c5503 200000c0 returned -22
[  372.485074] binder: 15547:15553 not enough space to store 0 fds in buffer
[  372.485099] binder: 15547:15553 transaction failed 29201/-22, size 120-24 line 3475
03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r5 = openat(r2, &(0x7f0000000100)='./file0\x00', 0x140, 0x10a)
ioctl$EVIOCGABS20(r5, 0x80184560, &(0x7f00000001c0)=""/151)

03:16:13 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/member\x00', 0x2, 0x0)
sendfile(r1, 0xffffffffffffffff, &(0x7f0000000400), 0x408000)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='S\x00\x00\x00up_id=', @ANYRESDEC=0x0])
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6, 0x4000007, 0x801}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000080)=0x10)
r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000340)={@multicast2, @remote}, &(0x7f0000000380)=0xc)
sendfile(r5, r3, 0x0, 0x8000fffffffd)

[  372.485569] binder: undelivered TRANSACTION_ERROR: 29201
[  372.543671] binder: 15546:15564 ioctl 405c5503 200000c0 returned -22
[  372.554413] binder: 15561:15566 got transaction with invalid offset (3667201280, min 0 max 120) or object.
[  372.577369] binder: 15561:15566 transaction failed 29201/-22, size 120-24 line 3379
03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
uname(&(0x7f0000000100)=""/70)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

[  372.595065] binder: 15570:15573 got transaction with invalid offset (-8947351279529622528, min 0 max 120) or object.
[  372.595090] binder: 15570:15573 transaction failed 29201/-22, size 120-24 line 3379
[  372.595224] binder: undelivered TRANSACTION_ERROR: 29201
[  372.602734] binder: 15570:15578 got transaction with invalid offset (-8947351279529622528, min 0 max 120) or object.
03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioprio_set$uid(0x3, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840ff010000000000000000000000000000000000000000000000000000295484150ca62396008000000900009f00000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="00000000000006500051db5dfdf4d6197929f911639d000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0)

03:16:13 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = fcntl$dupfd(r2, 0x406, 0xffffffffffffffff)
ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000000140))
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r4 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0)
ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000080)={0x8, 0x0, 0x1})

[  372.603260] binder: 15570:15578 transaction failed 29201/-22, size 120-24 line 3379
03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

03:16:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x3c497e10b182e1a0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x80000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x16}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x16}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000001c0)=<r6=>0x0)
ioprio_set$pid(0x1, r6, 0x8)

[  372.603493] binder: undelivered TRANSACTION_ERROR: 29201
[  372.655389] binder: 15577:15581 not enough space to store 0 fds in buffer
[  372.655414] binder: 15577:15581 transaction failed 29201/-22, size 120-24 line 3475
[  372.665664] binder: undelivered TRANSACTION_ERROR: 29201
[  372.667527] binder: 15577:15587 not enough space to store 0 fds in buffer
[  372.667554] binder: 15577:15587 transaction failed 29201/-22, size 120-24 line 3475
[  372.668586] binder: undelivered TRANSACTION_ERROR: 29201
[  372.680564] binder: 15585:15589 unknown command 0
[  372.680572] binder: 15585:15589 ioctl c0306201 20000180 returned -22
[  372.757468] binder: 15592:15594 got transaction to invalid handle
[  372.757478] binder: 15592:15594 transaction failed 29201/-22, size 140740007273996-2667577353 line 3138
03:16:13 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = openat$cgroup_ro(r1, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0)
setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000040)={0x100, 0x1, 0x9, 0x2, 0x8}, 0xc)
r5 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r6=>0xffffffffffffffff})
r7 = dup2(r6, r5)
ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200)
prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r8 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r8, 0x0, 0x0)
tkill(r8, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
write$P9_RRENAMEAT(r1, &(0x7f0000000100)={0x7, 0x4b, 0x2}, 0x7)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:13 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = openat$cgroup_procs(r4, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0)
dup2(r5, r3)
preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/37, 0x25}], 0x1, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, r0, 0x0, 0x8000fffffffe)

[  372.761734] binder: undelivered TRANSACTION_ERROR: 29201
[  372.807411] binder: 15602:15605 not enough space to store 0 fds in buffer
[  372.807437] binder: 15602:15605 transaction failed 29201/-22, size 112-24 line 3475
[  372.815345] binder: undelivered TRANSACTION_ERROR: 29201
[  372.880549] binder: undelivered TRANSACTION_ERROR: 29201
03:16:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x163, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0})
r4 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000012c0)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x38, 0x0, &(0x7f0000000140)=[@exit_looper, @register_looper, @acquire={0x40046305, 0x3}, @acquire={0x40046305, 0x1}, @dead_binder_done, @enter_looper, @free_buffer={0x40086303, r4}, @register_looper], 0x8c, 0x0, &(0x7f00000001c0)="d3c48074b4d75278352b45fa9d89563da9aa471ab66e576a08c394b94df6a6bdd57c83dbca4acb594e4e59fc394b97868fda11741081660c81b32ebd073a92f7389660f5edb25031237b401818da1c5b7bc9fc10c34091319231288150175ae04cc444b7dcd049dc1fbdb0449d0f24638fb5d7e5411c3d1993a297437f7d3e45c41ea80b28fa71451dac0b63"})
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BLKSECTGET(r5, 0x1267, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
ioctl$KDGKBENT(r4, 0x4b46, &(0x7f0000000280)={0x9, 0x9, 0x4})
ioctl$RTC_ALM_READ(r4, 0x80247008, &(0x7f0000000300))
r7 = syz_genetlink_get_family_id$tipc(0x0)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r8, 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r10)
mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r8, 0x0)
sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r7, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="455d5d009995892879beda8b7bd59486895fb7903c20c1c35d0bef7f278e133b15abf49c4e11a0d71d75a1cfd94ad2604ba6b387e7a2d087867e1123a7b3209236d1a7469e327b5ac1c1188c603582329e5a6eb74ef50f6f7c0534fac72702b00f2b233ff66db3244c3d54cf9177b141c11d006cefc4ba0cb3e952", @ANYRES16=r7, @ANYBLOB="00032bbd7000ffdbdf250100000000000000014100000018001700000017000000a369623a677265746170300000"], 0x2d}, 0x1, 0x0, 0x0, 0x20000801}, 0x8000)

03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000010000000028000000000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  372.943758] binder: BINDER_SET_CONTEXT_MGR already set
[  372.952400] binder: 15613:15622 not enough space to store 0 fds in buffer
[  372.952424] binder: 15613:15622 transaction failed 29201/-22, size 120-24 line 3475
[  372.952634] binder: undelivered TRANSACTION_ERROR: 29201
03:16:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000200)={<r3=>0x0, @loopback, @remote}, &(0x7f0000000240)=0xc)
ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000280)={@mcast2, @dev={0xfe, 0x80, [], 0x2a}, @empty, 0x7b, 0x3, 0x5, 0x400, 0xc3b0, 0x80000000, r3})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:13 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  372.954763] binder: 15617:15623 not enough space to store 0 fds in buffer
[  372.954784] binder: 15617:15623 transaction failed 29201/-22, size 120-24 line 3475
[  372.963440] binder: 15613:15624 not enough space to store 0 fds in buffer
03:16:13 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
msync(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0})
r3 = socket$inet(0x2, 0x0, 0x2)
ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000100)={'veth1\x00', 0x2})
r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INIT_INFO(r4, 0x0, 0x82, &(0x7f0000000340)={'broute\x00'}, &(0x7f00000003c0)=0x78)
setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f00000002c0)={{0xa, 0x4e21, 0x4, @local, 0x400}, {0xa, 0x4e21, 0x1, @ipv4={[], [], @loopback}, 0x1f}, 0x5, [0x4, 0x100, 0x6, 0x5, 0x3, 0x2304, 0x2, 0x800]}, 0x5c)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x1c, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x2}, @increfs_done={0x40106308, 0x1}], 0xee, 0x0, &(0x7f00000001c0)="49f7e22c53de267f57e1a7516f175ef57bac619bd9ed4ff5de5b6a389314e0437c8c0a5dcc23eae1df351810019944c26eb7e3c82fd58f262992df65b78fb430b80cfc6fb841492b3acf4dfa7fab0398e9af3dab21ecd97042e29df3105581e9f1471bb47871e84ed826bd58a704a1a979fb85c26811b113f9db6fc898b2e1704e0ad439134556ce0aa099d0639ca86f282d2ff57653963cb757d4c95ce07622699bf4932dac55d2408ededaf01314685bc2a0dbe44eb8773aaf99610135d67887ab9adc6495c97e720261ebb4a62df6ad83380cfd72589127daa612973e65ef7c10dc63e13328baadbbbc868d16"})

03:16:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={<r2=>0xffffffffffffffff})
preadv(r2, &(0x7f0000000700)=[{&(0x7f00000001c0)=""/131, 0x83}, {&(0x7f0000000280)=""/189, 0xbd}, {&(0x7f00000003c0)=""/205, 0xcd}, {&(0x7f00000004c0)=""/72, 0x48}, {&(0x7f0000000540)=""/142, 0x8e}, {&(0x7f0000000600)=""/224, 0xe0}], 0x6, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  372.963463] binder: 15613:15624 transaction failed 29201/-22, size 120-24 line 3475
[  372.963727] binder: undelivered TRANSACTION_ERROR: 29201
[  372.995339] binder: undelivered TRANSACTION_ERROR: 29201
[  373.000579] binder: 15617:15630 not enough space to store 0 fds in buffer
[  373.000610] binder: 15617:15630 transaction failed 29201/-22, size 120-24 line 3475
[  373.006271] binder: 15616:15627 BC_FREE_BUFFER u0000000000000000 no match
[  373.006343] binder: 15616:15627 ERROR: BC_REGISTER_LOOPER called without request
[  373.006354] binder: 15616:15627 Acquire 1 refcount change on invalid ref 3 ret -22
[  373.006363] binder: 15616:15627 Acquire 1 refcount change on invalid ref 1 ret -22
[  373.006371] binder: 15616:15627 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  373.006376] binder: 15616:15627 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER
[  373.006384] binder: 15616:15627 BC_FREE_BUFFER u0000000000000000 no match
[  373.006390] binder: 15616:15627 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[  373.018834] binder: undelivered TRANSACTION_ERROR: 29201
[  373.041722] binder: 15634:15636 got transaction with invalid offset (16777216, min 0 max 120) or object.
[  373.041747] binder: 15634:15636 transaction failed 29201/-22, size 120-24 line 3379
[  373.041882] binder: undelivered TRANSACTION_ERROR: 29201
[  373.073821] binder: 15639:15641 not enough space to store 0 fds in buffer
[  373.073849] binder: 15639:15641 transaction failed 29201/-22, size 120-24 line 3475
[  373.074045] binder: undelivered TRANSACTION_ERROR: 29201
[  373.141272] binder: 15647:15650 not enough space to store 0 fds in buffer
[  373.141297] binder: 15647:15650 transaction failed 29201/-22, size 120-24 line 3475
[  373.141538] binder: undelivered TRANSACTION_ERROR: 29201
[  373.142734] binder: 15645:15651 BC_FREE_BUFFER u0000000000000000 no match
[  373.146623] binder: 15647:15652 not enough space to store 0 fds in buffer
[  373.146646] binder: 15647:15652 transaction failed 29201/-22, size 120-24 line 3475
[  373.146946] binder: undelivered TRANSACTION_ERROR: 29201
[  373.193696] binder: 15645:15651 Release 1 refcount change on invalid ref 2 ret -22
[  373.193705] binder: 15645:15651 BC_INCREFS_DONE u0000000000000001 no match
[  373.359303] binder: 15616:15620 ioctl 40046207 0 returned -16
[  373.359339] binder_alloc: 15616: binder_alloc_buf, no vma
[  373.359387] binder: 15616:15627 transaction failed 29189/-3, size 120-24 line 3284
[  373.380642] binder: undelivered TRANSACTION_ERROR: 29189
[  373.387025] binder: BINDER_SET_CONTEXT_MGR already set
[  373.392493] binder: 15616:15627 ioctl 40046207 0 returned -16
[  373.398950] binder: 15616:15662 BC_FREE_BUFFER u0000000000000000 no match
[  373.406174] binder: 15616:15620 ERROR: BC_REGISTER_LOOPER called without request
[  373.413803] binder_alloc: 15616: binder_alloc_buf, no vma
[  373.413875] binder: 15616:15620 Acquire 1 refcount change on invalid ref 3 ret -22
[  373.413883] binder: 15616:15620 Acquire 1 refcount change on invalid ref 1 ret -22
[  373.413889] binder: 15616:15620 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  373.413895] binder: 15616:15620 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER
[  373.413902] binder: 15616:15620 BC_FREE_BUFFER u0000000000000000 no match
[  373.413907] binder: 15616:15620 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[  373.465759] binder: 15616:15662 transaction failed 29189/-3, size 120-24 line 3284
[  373.476770] binder: undelivered TRANSACTION_ERROR: 29189
[  373.938604] binder: 15645:15663 BC_FREE_BUFFER u0000000000000000 no match
[  373.946266] binder: 15645:15665 Release 1 refcount change on invalid ref 2 ret -22
[  373.954025] binder: 15645:15665 BC_INCREFS_DONE u0000000000000001 no match
03:16:16 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = creat(&(0x7f0000000100)='./file0\x00', 0x20)
write$P9_RXATTRCREATE(r3, &(0x7f0000000140)={0x7, 0x21, 0x2}, 0x7)
r4 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@window={0x3, 0x0, 0x1ff}], 0x1fcb)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000040)=0x6)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
read$FUSE(0xffffffffffffffff, &(0x7f0000000200), 0x1000)
setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000001c0)=@gcm_128={{0x303}, "ecfc9b075b9995cf", "85286288c8270ff8a9ee694f12df499c", "9ddbe79f", "1d8cb32e51170c4c"}, 0x28)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:16 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:16 executing program 5:
perf_event_open(&(0x7f0000000240)={0x4, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14fd85f1e8654b56, @perf_bp={0x0}, 0x20120, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
utimes(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000440)={{0x0, 0x7530}, {0x77359400}})
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffefffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
creat(&(0x7f0000000180)='./file0\x00', 0x20)
inotify_init1(0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8)
bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r2, 0x107, 0x1d, &(0x7f0000000100)=0x10000000004053a, 0x2cf)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
write$cgroup_type(r3, &(0x7f0000000340)='threaded\x00', 0xffffffc5)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c)
r4 = open(0x0, 0x0, 0x1c0)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300)='nbd\x00')
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00022bbd700000210060660c00"/35], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x1)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0)
r7 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
write$binfmt_aout(r7, 0x0, 0x0)
fallocate(r7, 0x0, 0x0, 0x2000002)
fallocate(r6, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r6, 0xc028660f, &(0x7f0000000040)={0x0, r7, 0x0, 0x8})
sendmsg$NBD_CMD_STATUS(r6, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x70, r5, 0x202, 0x70bd29, 0x25dfdbff, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x100000000}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x10044044}, 0x4000000)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
signalfd4(r1, &(0x7f0000000200)={0xffffffffffffff81}, 0x8, 0x80000)
socket$inet6(0xa, 0x400000000001, 0x0)

03:16:16 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f0000000140)=""/180)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r3, r1, 0x0, 0x8000fffffffe)

03:16:16 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000007c0)=ANY=[@ANYBLOB='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='\x00'/32], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e6ffffff00000000000000ebffffdfffffffff000000000000000000e3321760014e2e1e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0f6522f28ecbdadf00ff745a904cda91cf275d415ff6a74e08206329a0aa5fcce097d9e2080694d6fef7beec5a7b76983e832bdcd47e1fa605870a9acde390d0d278bf5e896c13cfa52b8dd051cf2eb89aa8962497048228b460fac732c5ad38be138a73c906f57738ef452d6018e518deb3654d10bbbb19b95f4d3b9b163a14d024c2ebb0e164fd79f791e88283f9726612748bb732fb622df02f98bb66c4c63d926dada575213d91eaab7125b4128de9bf52275da8403e155d68d12e0295324d91701826e5242a75848d9cb579ff325756bf0907cc7cc150a56f65fff66d3c528b5452133090c0934e01a41f78d79aa8db473baa350fe175f4515dd5552ee8c0fa318aa52755d3a7873b38d0cc00138242ab1289ba2b1471510143f3a4bf15be0578521106d693a7e621f52120f00ffadf609a32bfd234d99582e7bc8c7aa36d866f7b97478889fa79c7573f357b4"], 0x108)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x0, 0x503)
ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000000440)=0x1)
ioctl$PPPIOCCONNECT(r5, 0x4004743a, &(0x7f0000000380)=0x2)
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
syz_genetlink_get_family_id$team(&(0x7f00000003c0)='team\x00')
ioctl$EXT4_IOC_GROUP_ADD(r6, 0x40286608, &(0x7f00000000c0)={0x5, 0x2, 0x401, 0x7fff, 0x98, 0x8})
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_SHOW_LINK_STATS(r6, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="feffffff", @ANYRES16=0x0, @ANYBLOB="010626bdffffffffdf2501000000000000000b0000000014001462726f6164636163742d6c696e6b0000"], 0x30}}, 0x20004000)
openat$tun(0xffffffffffffff9c, &(0x7f0000000600)='/dev/net/tun\x00', 0x80, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000000)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000640)={@flat=@handle={0x73682a85, 0x0, 0x3}, @flat, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000780)={0x29b, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0})
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a40)={'syz0\x00', {0x255, 0x101, 0x3, 0x401}, 0xe, [0x40, 0x7, 0x82b, 0x800, 0x710c, 0xe3f, 0x5, 0x5, 0x200, 0x3, 0x3a7, 0x400, 0x4b17, 0x6, 0x7e, 0x4, 0x4, 0xbb, 0x2, 0x2, 0x401, 0x7, 0x4, 0x10000, 0x6ef, 0x6, 0x6, 0x9, 0xeac3, 0x0, 0x9, 0xc9, 0x1, 0xc7, 0x10001, 0x747, 0x1f, 0x1d, 0x10001, 0x2, 0x1000, 0x3, 0x8000, 0x1, 0x2, 0xffffff00, 0x5, 0x3, 0x3f, 0x5, 0xfffffffa, 0x11, 0x1, 0x3, 0x100, 0x8, 0x8, 0x1, 0x200, 0x10000, 0x4b5f, 0x5, 0x8, 0x3f], [0x6, 0x0, 0x7ff, 0x1, 0x7, 0x2, 0x8cc, 0x7f, 0x80000000, 0x80, 0x6, 0x1, 0x101, 0x625, 0x9, 0x10000, 0x7fffffff, 0xffffff09, 0x81, 0x9, 0x40, 0x9, 0x3, 0x100, 0x4, 0x1, 0xaca3, 0x80000001, 0x200, 0x80, 0x7fff, 0x3a, 0x2, 0x2, 0x2, 0x7e, 0x4ac, 0x3, 0x9, 0x3f, 0x9, 0x8, 0x1000, 0x3, 0x9, 0xef0, 0x4, 0x7fff, 0x3, 0x1ff, 0x4, 0x80000001, 0xffffffff, 0xeb5, 0x1fc0000, 0x0, 0x100, 0xffffffff, 0xffff, 0x4, 0x5, 0x9, 0xffffff7f, 0x8], [0x8, 0x0, 0x10001, 0x6, 0x7, 0x400, 0x1c57, 0x6, 0x4, 0x5, 0x401, 0x7fff, 0x80000001, 0xa584, 0x200, 0x7, 0x10001, 0x7f, 0xf64, 0xe3e8, 0x4, 0x5, 0x2, 0x6, 0x800, 0x1, 0x6, 0x3f, 0x2, 0xffffac5e, 0x1f, 0xf32, 0xe75e, 0x4, 0x5, 0x80000, 0x1, 0x8000, 0x7, 0x400, 0x3f, 0x1000, 0x6ae, 0x3, 0x8, 0x5, 0x9, 0x7, 0x3, 0x277, 0x1, 0x1, 0x5, 0x39, 0x7, 0x1f, 0x0, 0x0, 0x81, 0x9, 0x5, 0x1, 0x7, 0x675], [0x7, 0x1f, 0x7, 0x4, 0x101, 0x8, 0x80000000, 0x0, 0x40, 0x0, 0x0, 0x4, 0xffff, 0x1, 0x400, 0x40, 0x2, 0x800, 0x0, 0x7ff, 0x5, 0xffffff1d, 0x200, 0xbc45, 0x9, 0x8, 0x8, 0x0, 0x1, 0xd2eb, 0x6, 0x744, 0x400, 0x9, 0x9, 0xff, 0x3, 0x5, 0x1, 0x8, 0xa3a5, 0x42fb, 0x7, 0x2, 0x200, 0x4c, 0xce9b, 0x432, 0x1e41bc72, 0x9, 0x8001, 0xfffffffe, 0xf28, 0x9, 0xfff, 0x401, 0x63, 0x5, 0x10000, 0xe, 0xdc, 0x1, 0x8001, 0x16]}, 0x45c)
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480)='/dev/zero\x00', 0x114100, 0x0)
connect$unix(r7, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e)
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000280))

03:16:16 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = accept(0xffffffffffffffff, &(0x7f0000000200)=@ethernet={0x0, @dev}, &(0x7f0000000280)=0x80)
ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f00000002c0)={'bcsf0\x00', {0x2, 0x4e24, @multicast2}})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:16 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(0x0, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  375.940707] binder: 15671:15674 not enough space to store 0 fds in buffer
[  375.950530] binder: 15671:15674 transaction failed 29201/-22, size 120-24 line 3475
03:16:16 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
dup2(r2, r1)
r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2005, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000000))
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:16 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@empty, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000600)=0xe8)
ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000640)={@local, 0x1b, r2})
r3 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r4, r3, 0x0, 0x8000fffffffe)

[  375.983236] binder: undelivered TRANSACTION_ERROR: 29201
[  376.017739] binder: 15669:15679 got reply transaction with no transaction stack
03:16:16 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r2 = dup(r1)
write$nbd(r2, &(0x7f0000000100)={0x67446698, 0x0, 0x4, 0x4, 0x3, "5cc847d779cb11b05afa29ef01151a1747ef649e39bd16760ac00f26e579259a6a14504b0015d220a0d17f04f7a304b240c11e41b429d59504035b0c77ecb5f79365b8cf359ff409f72ff70d2b90d70337cba6dba06b786ac5003b"}, 0x6b)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  376.021847] binder: 15671:15684 not enough space to store 0 fds in buffer
03:16:16 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(0x0, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:16 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x800000000014}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:16 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000040)='./file1\x00', 0x30d140, 0x46)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="669782646dd13b58914e69b333b1f1c2b05ae11cdc56bbcbd3e4e56342b83fd9ea3a0a7c13530e383cf18d4ccd442ae865a6d4f29d2349897cde90e91d9e6cad1a3f2753aabe186d220d28ed99efc2880031b4382e0d46fe075baef5395f4759e104fe0ce63801dbf1", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  376.021874] binder: 15671:15684 transaction failed 29201/-22, size 120-24 line 3475
[  376.022102] binder: undelivered TRANSACTION_ERROR: 29201
03:16:16 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(0x0, 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  376.093119] binder: 15696:15699 not enough space to store 0 fds in buffer
[  376.093146] binder: 15696:15699 transaction failed 29201/-22, size 120-24 line 3475
[  376.093356] binder: undelivered TRANSACTION_ERROR: 29201
[  376.099899] binder: 15696:15701 not enough space to store 0 fds in buffer
[  376.099925] binder: 15696:15701 transaction failed 29201/-22, size 120-24 line 3475
[  376.100229] binder: undelivered TRANSACTION_ERROR: 29201
[  376.150535] binder: 15708:15709 not enough space to store 0 fds in buffer
[  376.150566] binder: 15708:15709 transaction failed 29201/-22, size 112-24 line 3475
[  376.150701] binder: undelivered TRANSACTION_ERROR: 29201
[  376.167613] binder: 15708:15711 not enough space to store 0 fds in buffer
[  376.167637] binder: 15708:15711 transaction failed 29201/-22, size 112-24 line 3475
[  376.167848] binder: undelivered TRANSACTION_ERROR: 29201
[  376.335926] binder: 15669:15679 transaction failed 29201/-71, size 72-24 line 3046
[  376.346759] binder: undelivered TRANSACTION_ERROR: 29201
[  376.348078] binder: BINDER_SET_CONTEXT_MGR already set
[  376.348086] binder: 15669:15698 ioctl 40046207 0 returned -16
03:16:17 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0xc00)
write(r2, &(0x7f0000000080)="cd8d19fb77cddd516689b86fa7bea48d56cfbe3820b24ea27b5cb19a2cbad554", 0x20)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="66643d8efcfcaa5b716f3923d43d5b48d88f45d9b98b4abedd06e51417", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r3, @ANYBLOB="2c670100c7d6e89eb137000000000004722f3b0e718d2bab57dd6b3e8a39093786b5283a2413caf08c6483c52e5e920886a06993a8f36673d846a46c18dc1c0f7731b63c989dc1fd7c9b8f86e8f293dbdb9171d3d49080b4f5b837080b0eb3e28c8ddff10f93d3d6ced56a488447395a179728459a09d4381aaf1053017c48d22d44e06a76b6d9a9efe2f6ae5acca970df1c3e2d8ac62744f30c2d0acf86c0fc", @ANYRESDEC=0x0])
sendfile(r3, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
execveat(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), &(0x7f0000000280)=[&(0x7f00000001c0)='{eth1cpusetcgroup\x00', &(0x7f0000000200)='/dev/binder#\x00', &(0x7f0000000240)='/dev/binder#\x00'], 0x1000)

03:16:17 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0), 0x0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r5, 0x6ac, 0x70bd2b, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x40000)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:17 executing program 1:
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x4001, 0x0)
write$P9_RWALK(r0, &(0x7f00000001c0)={0xffffffffffffff6e, 0x6f, 0x1, {0x6, [{0x0, 0x0, 0x5}, {0x80, 0xfffffffd, 0x2}, {0x41, 0x4, 0x4}, {0x40, 0x2, 0x6}, {0x52, 0x1, 0x4}, {0xc4, 0x1, 0x6}]}}, 0x57)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x95, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000780000000000000018000000000000001019d8b7dd4eb6efce87f0eff08ddb5aec1cf12eea2f7627f77faa6fec676e92d4794bff1c8cf9c205c6ed96d8b0fd9ed2e3106285655de8098d61c9129d8912dce86b4f15586b33180dc4183c4a58dc0ccca96dc442f758d36e9afaac2939cc4b368998d7e01f", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a747000000000000000000000000088ff00000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000004001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB="5aeac922ff394037dc5546bc3d599a740c259380000000000000005ac1b543a878eb4c2f796129fa6c415cbbd3bba376c708474a3b26ad90810ddddcc2879e79f8a97475b6cbe8c262b8b3caf200000000"], 0x0, 0x0, 0x0})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$TIOCNXCL(r3, 0x540d)

03:16:17 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
setsockopt$inet_mreq(r2, 0x0, 0x24, &(0x7f00000003c0)={@empty, @empty}, 0x8)
fsync(r1)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x2)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000100))
syslog(0x3, &(0x7f00000001c0)=""/197, 0xc5)
ioctl$RTC_PIE_OFF(r1, 0x7006)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:17 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r5 = getpid()
fcntl$lock(r4, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r5})
listen(r4, 0x200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xe4, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/159, 0x9f, 0x0, 0xc}, @fda={0x66646185, 0x6, 0x0, 0x1a}, @fda={0x66646185, 0x4, 0x0, 0x3f}}, &(0x7f0000000480)={0x0, 0x28, 0x48}}, 0x40}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r4}, @fda={0x66646185, 0x0, 0x1, 0x2c}, @fda={0x66646185, 0x1, 0x1, 0x26}}, &(0x7f0000000540)={0x0, 0x18, 0x38}}}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x22, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000600)={@ptr={0x70742a85, 0x0, &(0x7f0000000580)=""/23, 0x17, 0x0, 0x23}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/52, 0x34, 0x2, 0x3}}, &(0x7f0000000680)={0x0, 0x28, 0x40}}, 0x40}], 0x6e, 0x0, &(0x7f00000007c0)="1de823ad275cf195b152b2348ccec6545a2acafc3fbee1f70d649ab3225d21e62511e1d3346b91d5c93b7d941907076a534aa3a399b76ad02f3eddec3323243064172f62d5364c860cfc90209f61ff0cb9a934f91bc78232d2fdfb3dba62fedb1f71b29772eab718491da00b67b6"})
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r7 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_names\x00')
ioctl$sock_inet_SIOCGIFPFLAGS(r7, 0x8935, &(0x7f0000000140)={'sit0\x00', 0x7})
r8 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r8, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
ioctl$sock_inet_SIOCSIFPFLAGS(r8, 0x8934, &(0x7f0000000040)={'veth0_to_team\x00', 0x101})
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000002800000000001c005000000000000000"], @ANYBLOB="0000000000000000f432630c9064475decb585c7c6e870a8c22aeac8073800d51fe4f4d13d7fa4377a4b1b20d257d7c5d653a12347e713fa047871eafb487fea904e225772cf61cb764f18b0adc0ffcecaca58252f54470a9d621494a2fbccaf5d6775f485cbe5f71fc9f66c911f702993ce0e5752838989bcc836be210734b5ee58bfe3d13ead2f37303265eb82fd68eebc9c73d1cdd1e6b0a8d22f3f"], 0x0, 0x0, 0x0})

03:16:17 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[])
syslog(0x2, &(0x7f0000000040)=""/75, 0x4b)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  376.652562] binder_alloc: 15727: binder_alloc_buf size 2843512897587453312 failed, no address space
[  376.662896] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  376.664472] binder: 15730:15733 not enough space to store 0 fds in buffer
03:16:17 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x10000, 0x0)
ioctl$PPPIOCCONNECT(r4, 0x4004743a, &(0x7f0000000040)=0x1)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  376.664496] binder: 15730:15733 transaction failed 29201/-22, size 120-24 line 3475
[  376.665434] binder: undelivered TRANSACTION_ERROR: 29201
03:16:17 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="941afffffffffffd00f1c1272ecbe6adbb3287778c1d6e75527ff47e5e62c2a9936d0d28d9aff9b0cfc2000100"/59, @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x28, 0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r1, @ANYPTR=&(0x7f0000000340)=ANY=[], @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r4 = socket$inet6(0xa, 0x4, 0x3)
fchmod(r4, 0x4)
mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000)
openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x8000, 0x0)

03:16:17 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
pipe2(&(0x7f0000000100), 0x80000)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00P\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  376.670438] binder: 15730:15736 not enough space to store 0 fds in buffer
[  376.670461] binder: 15730:15736 transaction failed 29201/-22, size 120-24 line 3475
03:16:17 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="661a2d", @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64650000000030313030303030303030303030303034303030302c757365725f69643decdfef554fad72a443f141ec5cfc5b9987f4e4f2c114a852d9b2c868cd9184729a98a7704424b0433ecd546e1e9a46a2598c63c1426e", @ANYRESDEC=0x0, @ANYBLOB="2c67786f77d8ab33fc3d", @ANYRESDEC=0x0])
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
sendfile(r3, r1, 0x0, 0x8000fffffffb)

[  376.671131] binder: undelivered TRANSACTION_ERROR: 29201
[  376.768837] binder: 15744:15749 transaction failed 29189/-22, size 120-24 line 3138
[  376.769161] binder: undelivered TRANSACTION_ERROR: 29189
[  376.803892] binder: 15746:15754 not enough space to store 0 fds in buffer
[  376.803917] binder: 15746:15754 transaction failed 29201/-22, size 120-24 line 3475
[  376.804159] binder: undelivered TRANSACTION_ERROR: 29201
[  376.816356] binder: 15746:15758 not enough space to store 0 fds in buffer
[  376.816382] binder: 15746:15758 transaction failed 29201/-22, size 120-24 line 3475
[  376.816715] binder: undelivered TRANSACTION_ERROR: 29201
[  376.881893] binder: 15763:15769 unknown command 808464432
[  376.881901] binder: 15763:15769 ioctl c0306201 20000000 returned -22
[  376.916702] binder: 15770:15773 got transaction with invalid offset (5764607523034234880, min 0 max 120) or object.
[  376.918060] binder: 15770:15773 transaction failed 29201/-22, size 120-24 line 3379
[  376.918246] binder: undelivered TRANSACTION_ERROR: 29201
[  376.948362] binder: 15763:15780 unknown command 808464432
[  376.948370] binder: 15763:15780 ioctl c0306201 20000000 returned -22
03:16:17 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000140)=@req={0x1, 0x2, 0xfffffff9, 0xd74b}, 0x10)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5)

03:16:17 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:17 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000001c0))
preadv(r2, &(0x7f0000000140)=[{&(0x7f00000003c0)=""/148, 0x94}], 0x110, 0x500)
write$P9_RLERROR(r2, &(0x7f00000000c0)={0x16, 0x7, 0x1, {0xd, '/dev/binder#\x00'}}, 0xfffffffffffffed3)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = getpid()
fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(0xffffffffffffffff, 0x200)
epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, &(0x7f0000000200)={0x20000004})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="ae3300ebff00000000000004000000ed0e827aad3bdee700a16df643db56e268f5a76be754b3e47a57fb413d657bab7ec7182d44a0a7bece6e7c"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:17 executing program 0:
r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0x0, 0x1, 0x10}, 0xc)
fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x7)
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
lgetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='com.apple.system.Security\x00', &(0x7f0000000340)=""/69, 0x45)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772921dc9b85f6964", @ANYRESDEC=0x0])
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:17 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:17 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$getregs(0xc, 0x0, 0x2, &(0x7f0000000000)=""/110)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  377.197293] binder: 15727:15732 transaction failed 29201/-28, size 120-24 line 3284
[  377.207859] binder: undelivered TRANSACTION_ERROR: 29201
[  377.213719] binder: BINDER_SET_CONTEXT_MGR already set
[  377.213728] binder: 15727:15742 ioctl 40046207 0 returned -16
[  377.219833] binder_alloc: 15727: binder_alloc_buf, no vma
[  377.219851] binder: 15727:15791 transaction failed 29189/-3, size 120-24 line 3284
03:16:18 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:18 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x11}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x1820}], 0x0, 0x0, 0x0})

03:16:18 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x400, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, @ip6ip6={{0xc, 0x1, 'ip6\xdb\xe1@n'}, {0xc, 0x2, [@IFLA_IPTUN_PROTO={0x8}]}}}]}, 0x3c}}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r5, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000140)={@remote, 0x4d, r5})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  377.269587] binder: 15794:15797 got transaction with invalid offset (1099159319470, min 0 max 120) or object.
03:16:18 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={<r4=>0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
r6 = syz_open_procfs(r4, &(0x7f00000002c0)='net/dev\x00')
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r6, 0x29, 0x41, &(0x7f00000003c0)={'nat\x00', 0x3, [{}, {}, {}]}, 0x58)
ioctl$TUNSETGROUP(r2, 0x400454ce, r5)
r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x3141202}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)={0x1f8, r7, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xa472}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa14a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK={0x54, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0x6c, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x766a3fe}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x2}]}, @TIPC_NLA_BEARER={0x60, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @loopback, 0x21}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}]}, @TIPC_NLA_MON={0x44, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x10}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xc305}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfff}]}]}, 0x1f8}, 0x1, 0x0, 0x0, 0x3e5e6b083cb0da21}, 0x4040084)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r8, 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r10)
epoll_ctl$EPOLL_CTL_MOD(r8, 0x3, r1, &(0x7f0000000100)={0x10})

03:16:18 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  377.269618] binder: 15794:15797 transaction failed 29201/-22, size 120-24 line 3379
[  377.274617] binder: BINDER_SET_CONTEXT_MGR already set
03:16:18 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x4)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0xfffffffffffffe7f, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x34, 0x10, 0x705, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x14, 0x12, @bond_slave={{0x0, 0x1, 'bond_slave\x00'}, {0x0, 0x5, @IFLA_BOND_SLAVE_QUEUE_ID={0x0, 0x5, 0xbed}}}}]}, 0x34}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r4, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000080)={@empty, r4}, 0x14)
r5 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r5, 0x0, 0x0, 0x1000f4)
r6 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r8 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r8, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r9 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r8, r9)
fcntl$addseals(r9, 0x409, 0xb)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r7, r6, 0x0, 0x8000fffffffe)

03:16:18 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  377.274624] binder: 15799:15802 ioctl 40046207 0 returned -16
[  377.275121] binder_alloc: 15727: binder_alloc_buf, no vma
03:16:18 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$ASHMEM_GET_NAME(r2, 0x81007702, &(0x7f00000001c0)=""/163)
r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f0000000140)={0x1ff, 0x1, 0x7fffffff, 0xd6b, 0x9, 0xad, 0x3f, 0x6, 0x7ff, 0xffff, 0x5, 0x3ff})
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r5 = getpid()
fcntl$lock(r4, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r5})
listen(r4, 0x200)
fstat(r4, &(0x7f00000003c0))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:18 executing program 3:
setxattr$security_smack_entry(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)='security.SMACK64IPIN\x00', &(0x7f00000006c0)='/selinux/avc/cache_threshold\x00', 0x1d, 0x3)
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = add_key(&(0x7f0000000240)='big_key\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000000700)=0x3)
r4 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r4)
add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f00000001c0)="ef61a23a703935b1cf0800000000000000e5d2388a81e87527815c040b9b9f0c73a34965634787edfcd3b9efeeb4cfdb6225f6ef92700ac41363b8bbdd36bd198ab6e50ae0fabfce377bd3a4db3a68fb979753097973fb", 0x15, r4)
r5 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r6 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x8}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r5, r6)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x2c, 0x0, &(0x7f00000004c0)=ANY=[@ANYRES32=r6, @ANYRES16], 0x0, 0x0, 0x0})
r7 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0, 0x0, r4)
mount(&(0x7f00000003c0)=@sr0='/dev/sr0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='jffs2\x00', 0x80, 0x0)
r8 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000500)=""/68)
ioctl$BLKTRACESTOP(r8, 0x1275, 0x0)
r9 = socket$netlink(0x10, 0x3, 0xa)
recvfrom(r9, &(0x7f0000000580)=""/175, 0xaf, 0x10002, 0x0, 0x0)
keyctl$search(0xa, r2, &(0x7f0000000000)='blacklist\x00', &(0x7f0000000300)={'syz', 0x1}, r7)

[  377.275136] binder: 15799:15802 transaction failed 29189/-3, size 120-24 line 3284
03:16:18 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  377.278750] binder: BINDER_SET_CONTEXT_MGR already set
03:16:18 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000140)={0x2a, 0x6, 0x0, {0x3, 0x3, 0x1, 0x0, '^'}}, 0x2a)
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0)
ioctl$KDGKBMETA(r6, 0x4b62, &(0x7f0000000080))

[  377.278758] binder: 15799:15806 ioctl 40046207 0 returned -16
[  377.278952] binder_alloc: 15727: binder_alloc_buf, no vma
[  377.278968] binder: 15799:15806 transaction failed 29189/-3, size 120-24 line 3284
[  377.284377] binder: BINDER_SET_CONTEXT_MGR already set
[  377.284387] binder: 15794:15804 ioctl 40046207 0 returned -16
[  377.295064] binder_alloc: 15794: binder_alloc_buf, no vma
[  377.295081] binder: 15794:15804 transaction failed 29189/-3, size 120-24 line 3284
[  377.301296] binder: 15795:15803 not enough space to store 2 fds in buffer
[  377.301322] binder: 15795:15803 transaction failed 29201/-22, size 112-24 line 3475
[  377.353876] binder: BINDER_SET_CONTEXT_MGR already set
[  377.353885] binder: 15795:15803 ioctl 40046207 0 returned -16
[  377.388003] binder: BINDER_SET_CONTEXT_MGR already set
[  377.388010] binder: 15816:15819 ioctl 40046207 0 returned -16
[  377.389928] binder: 15816:15819 got transaction to invalid handle
[  377.389937] binder: 15816:15819 transaction failed 29201/-22, size 112-24 line 3138
[  377.419316] binder: BINDER_SET_CONTEXT_MGR already set
[  377.419325] binder: 15816:15823 ioctl 40046207 0 returned -16
[  377.419395] binder: 15816:15823 got transaction to invalid handle
[  377.419403] binder: 15816:15823 transaction failed 29201/-22, size 112-24 line 3138
[  377.433810] binder: BINDER_SET_CONTEXT_MGR already set
[  377.433818] binder: 15821:15822 ioctl 40046207 0 returned -16
[  377.435006] binder_alloc: 15727: binder_alloc_buf, no vma
[  377.435025] binder: 15821:15822 transaction failed 29189/-3, size 120-24 line 3284
[  377.443383] binder: BINDER_SET_CONTEXT_MGR already set
[  377.443391] binder: 15824:15827 ioctl 40046207 0 returned -16
[  377.444698] binder_alloc: 15795: binder_alloc_buf, no vma
[  377.444716] binder: 15824:15827 transaction failed 29189/-3, size 120-24 line 3284
[  377.475215] binder: BINDER_SET_CONTEXT_MGR already set
[  377.475224] binder: 15824:15831 ioctl 40046207 0 returned -16
[  377.481628] binder: BINDER_SET_CONTEXT_MGR already set
[  377.481635] binder: 15821:15828 ioctl 40046207 0 returned -16
[  377.561821] selinux_nlmsg_perm: 5 callbacks suppressed
[  377.561829] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=15839 comm=syz-executor.0
[  377.597805] binder: BINDER_SET_CONTEXT_MGR already set
[  377.597813] binder: 15840:15842 ioctl 40046207 0 returned -16
[  377.597951] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pig=15839 comm=syz-executor.0
[  377.599963] binder: BINDER_SET_CONTEXT_MGR already set
[  377.599970] binder: 15841:15843 ioctl 40046207 0 returned -16
[  377.607598] binder_alloc: 15795: binder_alloc_buf, no vma
[  377.607617] binder: 15840:15842 transaction failed 29189/-3, size 120-24 line 3284
[  377.613815] binder: 15841:15843 unknown command -1
[  377.613822] binder: 15841:15843 ioctl c0306201 20000180 returned -22
[  377.616385] audit: type=1400 audit(1572146178.307:56): avc:  denied  { read } for  pid=15841 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1
[  377.624233] binder: BINDER_SET_CONTEXT_MGR already set
[  377.624242] binder: 15840:15845 ioctl 40046207 0 returned -16
[  377.956640] binder: undelivered TRANSACTION_ERROR: 29189
[  377.962289] binder: undelivered TRANSACTION_ERROR: 29189
[  377.967949] binder: undelivered TRANSACTION_ERROR: 29189
[  377.973531] binder: undelivered TRANSACTION_ERROR: 29201
[  377.979143] binder: undelivered TRANSACTION_ERROR: 29201
[  377.984778] binder: undelivered TRANSACTION_ERROR: 29201
[  377.990395] binder: undelivered TRANSACTION_ERROR: 29189
[  377.995968] binder: undelivered TRANSACTION_ERROR: 29189
[  378.001569] binder: undelivered TRANSACTION_ERROR: 29189
[  378.007166] binder: undelivered TRANSACTION_ERROR: 29201
[  378.012830] binder: undelivered TRANSACTION_ERROR: 29189
03:16:20 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@broadcast}, 0x0, @in=@dev}}, &(0x7f00000003c0)=0xe8)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
getgroups(0x8, &(0x7f0000000400)=[0xffffffffffffffff, 0xee00, 0xffffffffffffffff, <r8=>0xee00, 0xffffffffffffffff, 0xee00, r7, 0x0])
mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='fuse\x00', 0x40, &(0x7f0000000440)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x5}}, {@max_read={'max_read', 0x3d, 0x1}}, {@max_read={'max_read'}}, {@blksize={'blksize', 0x3d, 0x400}}], [{@fowner_gt={'fowner>', 0xffffffffffffffff}}]}})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r9 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r10 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', 0x0, 0x8}, 0x10)
fcntl$setflags(r10, 0x2, 0x3)

03:16:20 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x400, 0x0)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000100)={0x0, 0x80}, 0x8)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x6, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:20 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:20 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
io_setup(0x8, &(0x7f00000004c0)=<r1=>0x0)
io_getevents(r1, 0x4, 0x4, &(0x7f00000000c0)=[{}, {}, {}, {}], 0x0)
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
r4 = creat(&(0x7f0000000100)='./file0\x00', 0x104)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
io_submit(r1, 0x2, &(0x7f0000000300)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x401, r3, &(0x7f00000001c0)="1c77763754e07b17aa30e709b4d6eb1d7ca138f859129d3ba956f5e2e89ac35e68176f047994926ea710b371fd877c13278409380d2ae2d0dba72bc6088afaf6ea35cc43abb5a39dcb0b14dd9a04d1a5eb6e85d5f16debf103905248352ee847379a3944c47d7396927a0db8e1b6933ea3097443864c6d8f2e8e3c159e8c22704dc0350bd8abb26d59b957584e20903409a8f5ca8acc9a2642e9de58529532561a9021e5f884705628ff307f54d32c822cca897496db823f372577f2e2e3f5347fd5ff3d49d31c18b7f75041f7729b107fc1f7c809731c6f47a63875eb4a0bbd8e2b6113ccb2700dc01cdbcfe854c3e282c7", 0xf2, 0x6, 0x0, 0x1981efb23f7107c0, r4}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8, 0x7, r0, &(0x7f00000003c0)="69aa66ced60a6baf0722e2a9747ced8e71b688f3397f0fcb6e895b55dc8548cfe30952012ae9a4f33a768730e4310df33e8392b26af75c78d2182f0f4e780b803df639d5fcb528265330e7f581c3e48a31c6389572009316930155728ac459ff383694f9cb0b4f277b427ec644880a763b36fe23f0f11da9374cc63a124895286538a5f55c7d94f9bd778433b8f3c20f167237a122d54e93496a21d8ff391c5230b77930526cf2ab45d0d32b", 0xac, 0x59c2, 0x0, 0x0, r5}])
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:20 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:20 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)=<r1=>0x0)
prctl$PR_SET_PTRACER(0x59616d61, r1)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:20 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x80000000000, 0x1, 0x14}}, &(0x7f00000000c0)={0xfffffffffffffd73, 0x28, 0x270}}}], 0x0, 0x0, 0x0})
exit(0x86)

03:16:21 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67720700bae6860000", @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  380.274659] binder: 15862:15866 not enough space to store 0 fds in buffer
[  380.287865] binder: 15862:15866 transaction failed 29201/-22, size 120-24 line 3475
[  380.289955] binder: 15864:15871 not enough space to store 0 fds in buffer
[  380.289977] binder: 15864:15871 transaction failed 29201/-22, size 120-24 line 3475
[  380.290317] binder: undelivered TRANSACTION_ERROR: 29201
03:16:21 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:21 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f00000000c0)=[@request_death={0x400c630e, 0x9}, @dead_binder_done, @increfs={0x40046304, 0x4}, @dead_binder_done, @decrefs], 0x0, 0x0, 0x0})
mknod(&(0x7f0000000100)='./file0\x00', 0x20, 0xfffffff7)

[  380.327390] binder: undelivered TRANSACTION_ERROR: 29201
[  380.350169] binder: 15862:15880 not enough space to store 0 fds in buffer
[  380.360405] binder: 15862:15880 transaction failed 29201/-22, size 120-24 line 3475
[  380.370673] binder: undelivered TRANSACTION_ERROR: 29201
03:16:21 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id='])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:21 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
capget(&(0x7f0000000040)={0x75f10b03e363d559}, &(0x7f0000000080)={0x6d317dcf, 0xffffffff, 0xc0000000, 0x126, 0x3})
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  380.397590] binder: 15882:15886 got transaction with invalid offset (-653, min 0 max 120) or object.
[  380.418570] binder: 15892:15895 BC_REQUEST_DEATH_NOTIFICATION invalid ref 9
[  380.418580] binder: 15892:15895 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  380.418587] binder: 15892:15895 IncRefs 0 refcount change on invalid ref 4 ret -22
03:16:21 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0xfffe, 0x0, @dev={0xfe, 0x80, [], 0x1f}}, 0x6620b796)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0)
wait4(0x0, 0x0, 0x0, 0x0)

[  380.418593] binder: 15892:15895 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  380.418601] binder: 15892:15895 DecRefs 0 refcount change on invalid ref 0 ret -22
[  380.462050] binder: 15892:15896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 9
[  380.462060] binder: 15892:15896 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  380.462070] binder: 15892:15896 IncRefs 0 refcount change on invalid ref 4 ret -22
[  380.462076] binder: 15892:15896 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  380.462085] binder: 15892:15896 DecRefs 0 refcount change on invalid ref 0 ret -22
[  380.527445] binder: 15882:15886 transaction failed 29201/-22, size 120-24 line 3379
03:16:21 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id='])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:21 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x1}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:21 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000140)={'bond_slave_0\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x5, [0x100, 0x8, 0x8001, 0x2000000, 0x4]}})
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
getsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:21 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0)

03:16:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000007c000000000000001800000000000000b63847433cd28665949631286187e5d61e79e485dffb3c356531d265e8a04d58b6", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:21 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @flat=@handle={0x73682a85, 0x100, 0x3}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x3, 0x40}}}], 0x0, 0x0, 0x0})

[  381.170874] binder: undelivered TRANSACTION_ERROR: 29201
[  381.176454] binder: BINDER_SET_CONTEXT_MGR already set
[  381.181802] binder: 15882:15914 ioctl 40046207 0 returned -16
[  381.188415] binder: 15882:15914 transaction failed 29189/-22, size 120-24 line 3138
[  381.196703] binder: undelivered TRANSACTION_ERROR: 29189
03:16:21 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id='])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:21 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0xaaa5d1d7b27d8768, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(r2, 0x200)
ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000100))

[  381.228316] binder: 15917:15920 not enough space to store 0 fds in buffer
[  381.238812] binder: 15917:15920 transaction failed 29201/-22, size 112-24 line 3475
[  381.250232] binder: 15923:15925 got transaction with invalid offset (3, min 40 max 96) or object.
[  381.250257] binder: 15923:15925 transaction failed 29201/-22, size 96-24 line 3379
03:16:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000f55db70000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646f008b2cad457a00000000000000000000000100000000001d0014310000000000000000000000542727eead7afb174ed71d8522257f0000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
r4 = getpgrp(r3)
prctl$PR_SET_PTRACER(0x59616d61, r4)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/arp\x00')
pselect6(0x40, &(0x7f00000002c0)={0x8001, 0x10001, 0x9, 0x9, 0x4, 0x1, 0x50, 0x80}, &(0x7f0000000300)={0x10001, 0x1, 0x9, 0x100000000, 0x8, 0x3ff, 0x5c}, &(0x7f0000000340)={0x3, 0x2, 0x1, 0x8, 0xfd, 0x7ff, 0x10000, 0x5}, &(0x7f0000000380)={0x77359400}, &(0x7f0000000400)={&(0x7f00000003c0)={0x100}, 0x8})
getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14)

03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  381.250391] binder: undelivered TRANSACTION_ERROR: 29201
[  381.263201] binder_alloc: 15924: binder_alloc_buf size 3836217920055441848 failed, no address space
03:16:22 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = getpid()
fcntl$lock(r6, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r7})
listen(r6, 0x200)
sendfile(r3, r6, &(0x7f0000000040), 0x6)

03:16:22 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
write$binfmt_script(r0, &(0x7f00000001c0)={'#! ', './file0', [{0x20, 'em0wlan1'}, {0x20, 'em0'}, {0x20, '/dev/binder#\x00'}, {0x20, '/dev/binder#\x00'}, {0x20, '(em1system'}], 0xa, "b71202f2ec46cd806c74ae8ecceb5db2760b2ee2416393be4c4af666c63eba1f5e3307a5ee0c802d3eb88bc54597eff2bcdd48b1fac10b6e45c0c1b554adcc5996e12124c0b31b8b706be0b9c3434b8d6dbf4847e0392ce49d0cf935ac255036a79809544d9684a1f56900194e4ca33e9c0ae92dd500b0d597c3d0b589878f51a8adcb06f7d450ec931e5a8106256e509c489c6df0fbd21b6551fc7385394b56670a781287686355a5fb1f947bb35725cec354abeb61b0c1f0742aeabceee55041ea4a3a818120e91633fb22ae07f78c36c48cc2b1d257edb20b5ac2"}, 0x11b)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  381.263208] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  381.263225] binder: 15924:15927 transaction failed 29201/-28, size 124-24 line 3284
[  381.263370] binder: undelivered TRANSACTION_ERROR: 29201
03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  381.283272] binder_alloc: 15924: binder_alloc_buf size 3836217920055441848 failed, no address space
[  381.283280] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  381.283297] binder: 15924:15929 transaction failed 29201/-28, size 124-24 line 3284
[  381.283692] binder: undelivered TRANSACTION_ERROR: 29201
[  381.322588] binder: 15933:15939 got transaction with invalid offset (-6150278991761799320, min 40 max 120) or object.
[  381.322613] binder: 15933:15939 transaction failed 29201/-22, size 120-24 line 3379
[  381.323361] binder: undelivered TRANSACTION_ERROR: 29201
[  381.342078] binder: 15938:15942 got transaction with invalid offset (0, min 0 max 120) or object.
[  381.342101] binder: 15938:15942 transaction failed 29201/-22, size 120-24 line 3379
[  381.364489] binder: undelivered TRANSACTION_ERROR: 29201
[  381.368818] binder: 15938:15947 got transaction with invalid offset (0, min 0 max 120) or object.
[  381.368843] binder: 15938:15947 transaction failed 29201/-22, size 120-24 line 3379
[  381.377943] binder: undelivered TRANSACTION_ERROR: 29201
[  381.406167] binder: 15950:15952 not enough space to store 0 fds in buffer
03:16:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000000000000000000000000000000000000000ecff0000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000b6c10000000068000000000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x100)
setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, &(0x7f0000000140)=0x3, 0x4)

03:16:22 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="068dc5ab25863be5cd4bd5b086a25368ee7cc311d2e25af7629d", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x7}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:22 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x10)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x163, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})
llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/74, 0x4a)

03:16:22 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x10000000000fff)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  381.406187] binder: 15950:15952 transaction failed 29201/-22, size 120-24 line 3475
[  381.406301] binder: undelivered TRANSACTION_ERROR: 29201
[  381.542044] binder: undelivered TRANSACTION_ERROR: 29201
[  381.547865] binder: BINDER_SET_CONTEXT_MGR already set
[  381.553276] binder: 15917:15961 ioctl 40046207 0 returned -16
03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x1)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x101402, 0x0)
ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000140)={0x3, 0xfff, 0xff})
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
r6 = accept4(r3, 0x0, &(0x7f00000001c0), 0x800)
r7 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r7, 0x4024700a, 0x0)
preadv(r7, &(0x7f00000017c0), 0x1fe, 0x500)
getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, <r8=>0x0}, &(0x7f00000002c0)=0x14)
setsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000300)={r8, @rand_addr, @remote}, 0xc)
r9 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="007ffffff2000000"], 0x0, 0x0, 0x0})

03:16:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/access\x00', 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
fcntl$lock(r1, 0x7, &(0x7f0000000140)={0x2, 0x4, 0x100000000, 0x8})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000020000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000001000053c0000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  381.584283] binder: 15962:15970 unknown command 0
[  381.588934] binder: 15967:15971 got transaction with invalid offset (3249930240, min 0 max 120) or object.
[  381.593395] binder: 15967:15971 transaction failed 29201/-22, size 120-24 line 3379
03:16:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x2000000, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  381.593416] binder: 15964:15973 not enough space to store 0 fds in buffer
[  381.593438] binder: 15964:15973 transaction failed 29201/-22, size 112-24 line 3475
03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x4000, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r1, &(0x7f0000000140)="6302bfcbf48a78e8ae7b42806440ae815c833a0a1cdd49c96b0c686888"}, 0x20)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x2, 0x50}}}], 0x0, 0x0, 0x0})

03:16:22 executing program 0:
creat(&(0x7f0000000300)='./bus\x00', 0x1c8)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
write$FUSE_OPEN(0xffffffffffffffff, &(0x7f0000000040)={0x20, 0xfffffffffffffffe, 0x5, {0x0, 0x4}}, 0x20)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  381.593573] binder: undelivered TRANSACTION_ERROR: 29201
[  381.594328] binder: undelivered TRANSACTION_ERROR: 29201
[  381.609359] binder: 15967:15977 got transaction with invalid offset (3249930240, min 0 max 120) or object.
[  381.609383] binder: 15967:15977 transaction failed 29201/-22, size 120-24 line 3379
[  381.610134] binder: undelivered TRANSACTION_ERROR: 29201
[  381.658292] binder: 15984:15987 got transaction with invalid offset (360305562375684096, min 0 max 112) or object.
[  381.658315] binder: 15984:15987 transaction failed 29201/-22, size 112-24 line 3379
[  381.658450] binder: undelivered TRANSACTION_ERROR: 29201
[  381.681623] binder_alloc: 15983: binder_alloc_buf, no vma
[  381.681640] binder: 15983:15991 transaction failed 29189/-3, size 120-24 line 3284
[  381.681951] binder: undelivered TRANSACTION_ERROR: 29189
[  381.715399] binder_alloc: 15983: binder_alloc_buf, no vma
[  381.715417] binder: 15983:15993 transaction failed 29189/-3, size 120-24 line 3284
[  381.715854] binder: undelivered TRANSACTION_ERROR: 29189
[  381.751670] binder: 15996:15998 not enough space to store 0 fds in buffer
[  381.751696] binder: 15996:15998 transaction failed 29201/-22, size 112-24 line 3475
[  381.751828] binder: undelivered TRANSACTION_ERROR: 29201
[  381.759052] binder: 15996:16000 not enough space to store 0 fds in buffer
[  381.759081] binder: 15996:16000 transaction failed 29201/-22, size 112-24 line 3475
[  381.759329] binder: undelivered TRANSACTION_ERROR: 29201
[  381.815553] binder: 16003:16007 got transaction with invalid offset (2, min 40 max 120) or object.
03:16:22 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:22 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00'}, 0x10)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="016340400200000000000000000000000000bf000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00'/132], @ANYBLOB="840000000000000001000000000000001900000000000000852a646600000000", @ANYRES32=r2, @ANYBLOB="0000000000000000000000008561646600000000070000000000000000000000000000002900000000000000"], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="970200000000000028000000000000004000000000000000"]], 0x0, 0x0, 0x0})

03:16:22 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = gettid()
ptrace$setsig(0x4203, r1, 0x2f65cf8e, &(0x7f0000000100)={0x8, 0xbb})
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  381.815580] binder: 16003:16007 transaction failed 29201/-22, size 120-24 line 3379
[  381.815718] binder: undelivered TRANSACTION_ERROR: 29201
[  381.822014] binder: 16003:16009 got transaction with invalid offset (2, min 40 max 120) or object.
[  381.822038] binder: 16003:16009 transaction failed 29201/-22, size 120-24 line 3379
[  381.822269] binder: undelivered TRANSACTION_ERROR: 29201
[  381.955831] binder: 15962:15970 ioctl c0306201 20000140 returned -22
[  381.990377] binder: 16015:16018 not enough space to store 0 fds in buffer
[  381.991474] binder: 16017:16019 got reply transaction with no transaction stack
[  381.991481] binder: 16017:16019 transaction failed 29201/-71, size 96-24 line 3046
[  381.991590] binder: undelivered TRANSACTION_ERROR: 29201
[  382.032099] binder: 16015:16018 transaction failed 29201/-22, size 120-24 line 3475
[  382.059615] binder: undelivered TRANSACTION_ERROR: 29201
03:16:25 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x2)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:25 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
write$P9_RRENAME(r3, &(0x7f0000000040)={0x7, 0x15, 0x2}, 0x7)
ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080))
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:25 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:25 executing program 3:
ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@empty, @ipv4={[], [], @remote}, @mcast1, 0x0, 0x3, 0x4, 0x100, 0xffffffffffff8001, 0x4040200})
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
r3 = fcntl$dupfd(0xffffffffffffffff, 0x406, r0)
accept(r3, &(0x7f0000000180)=@alg, &(0x7f00000000c0)=0x80)
r4 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='mUm\x85\x06yn\x92\b\xbdpts\x00\xf4\xad\xa8\xa2\xab\xf76\x05\x110\xab6\xc3\xcc\"\xd5\xf8\xe2\x85ysbM\xb3\xa9@\xa5F\xd8\xbf\xc3\xbc\x866{\xac\xea^\xdd\xffk\xec\x9a\xf39', 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r4)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0)
r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)

03:16:25 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = getpid()
fcntl$lock(r1, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r2})
listen(r1, 0x200)
recvmsg(r1, &(0x7f0000001540)={&(0x7f00000003c0)=@can, 0x80, &(0x7f0000001480)=[{&(0x7f0000000440)=""/42, 0x2a}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x2, &(0x7f00000014c0)=""/127, 0x7f}, 0x20)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x1, 0x0}, @flat=@handle={0x73682a85, 0x6a019e644190e67e, 0x3}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x290c2b15f7299f8e, 0x50}}}], 0x0, 0x0, 0x0})
openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0xaf1840, 0x0)
creat(&(0x7f00000015c0)='./file0\x00', 0x0)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
r5 = syz_genetlink_get_family_id$SEG6(0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000001600)='/dev/fuse\x00', 0x2, 0x0)
sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10040020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x2c, r5, 0x0, 0x70bd27, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_SECRETLEN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000040}, 0x0)
sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x500001}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000429bd3000fcdbdf25010000001e000300ffcdc87e2d71b0e311000100f7ff05006900000014000100fe8000001000000000000000000000bb14000100fe8000000000000000000000e2ff0022"], 0x54}, 0x1, 0x0, 0x0, 0x20018084}, 0x4000000)
ioctl$TCSETAW(r4, 0x5407, &(0x7f0000001580)={0x8, 0x1, 0x4, 0x80, 0x0, 0x1, 0xe6, 0x9, 0x1, 0x7})

03:16:25 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000140)={0x0, <r5=>0x0}, &(0x7f00000001c0)=0xc)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r8 = getpid()
fcntl$lock(r7, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r8})
listen(r7, 0x200)
sendmsg$nl_generic(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x4b4, 0x30, 0x20, 0x70bd29, 0x25dfdbfb, {0x17}, [@nested={0xb4, 0x4e, [@typed={0xb0, 0x8a, @binary="bbbad678902240033f62e27e0b5c3cb1ba6eb47df456c36d69522b1c074e3bf2671c2c0e11788a52b548731ffeeae9af22505674247962c0753e80d42dc4906e7896ece0adef621463e83448941e58b882f31530873692b329a86524570a0131006f9e6e6f07fd8d65025a5f5b811b620054e209a8919517d38dd1431443d17944bfd41b857cd7077a6b4fa5e1e7fd131e153252ef6b6013ef415a9ffa733e232f9d1e71406238d6391c7146"}]}, @generic="7f2ababaca7423165dcbed3e16", @generic="998b713acd2e11eb58442360d91e191a7311f8eaffa08497cf3185502528336c9afa2cf7a994eeff1097e4ec7529e3a30ecfd77868efc4e219b23857c47366ad1b869861afe93b549ff2697831a2ba88494b103d96e900af3d1c9ccd646bbc67413bfd49dbac9b7588bd3e66ad9eb7ca030a0c3dcdc7c9bf829e235165650d8dc89ac22d5fa70d8bfaa0fc28068eeb4ef83e3872442cf8b63910bee8ec48b71a63a6285c21eebc02d9d11233cbcac638b2e5f2c91fa7994db24f41b0c4c054d01f266c8a934fec0fe66e8665311ede12c59acfed3ed9612b12cb2b9c81da3f33638a3d4d4c4bdf252806ff435b7e10c748678a53eab0f3639e50f09a", @typed={0x8, 0x14, @uid=r5}, @generic="55069a372a1f851682a6393af40d4e024f3e1c734ff7f482f3a55617ec2b8d6f82a2802a8a0e63e472c545abb08ba88eb1e9b8a6f60edccff4cdc55e8201747b858bda", @typed={0x6c, 0x8001, @binary="98ea4bd545225226f38df7da3ae7ec94d8d6d61b64ce1f2de93c85d8904007614546c1ff41b535ab4ef597a23c53cc517ee82579ea11e28aae8f2cce7288238d0f7a06b8306310f9f90a966d4ab6f3d033f97418d0cc30cd3f387eab16763d1c8f49268ef13c"}, @nested={0x22c, 0x54, [@typed={0x8, 0x69, @fd=r6}, @typed={0x14, 0x63, @str='/dev/binder#\x00'}, @generic="84b2d2101241820cd59c08119c8f6051c3ba9ba52462ea7749fbc6f80e20ead710492a2802d880ed99eca090d5a88633d437", @typed={0x8, 0x18, @fd=r7}, @generic="c722020a529ff888f7fa1032087127ca9114cfad034d8d49260473ff07ebe960113b71f3fc919c467c7cbd0d4d2e2b630646bb0f0787f42ed8f46df559fb1502154e8292097d2e8a2bbf37e4d7df267127cc3a2135d6af5512e9edf3e69091ad77f8cb5bf6f8976e2bbb599bd8c6dcd901e6f64701d6b8c830647c9b0a025a8c05eae2c7718f3e8a2bef1755e72f49c84909bc2618ffb19ac7ca436965f08f48efa0b69fbc3b3059e608909248f63970d9b0a908813962ae72c4f085da0218aaa34071ae1ad21a4993b926301ac11678276e3cdb", @generic="7da4e5cfbde4051ea30a2fdaa52e349d69ceb6457c37327d81132af85a872a6a49b16a65a16e73fd62f876fc174c7de6b10671fcfef311450922b9877943f44ddf560ef1a408734e411358a36fa4372e032bf1aeb9c771154bee1826af28bb8b63a20ccdb31577e6ec7f09d12dbc049c4e82f42878e14f22dda540b2aae4123e9e487224aef8aeeae4c38d6f95c9aa5523d6d495c8c5a5df5d64f9ab5e9402632674f9cbf1d5ef120af841e36dbfd5b9b56a4896dd65a5ddf2a16b11b2484ff1793dadb0f3775f4d67d53c6dae130ea6e68627012be81cfa8f5a64968db220dfd340bb63d06e7e90c44dbef3514baa0eb52c96e7086045b4c7be64c82e"]}]}, 0x4b4}, 0x1, 0x0, 0x0, 0x90}, 0x2c000004)

03:16:25 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:25 executing program 4:
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200403, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x9a74df07cb67b3dd, &(0x7f0000000040), &(0x7f0000000100)=0x4)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r2 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r1, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r1, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:25 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000007800000000000000180000000000000048806358e6eb301e0490dd55494b57ac0672ff8a41706d6dbe96acaf2888f1c768f6938cd70506f3e355f2d99f42f87a667ee483671980aee220783604a1c3b10eaac133a9ddb34e85869374e6deda5beb157c2d72a6da1e3ef84a6856bc6faf5f2a39d5c4ac836d3dea4e31ca6f5ea827fe20e4fcb94cb392eabbade88f92d3e7d8daab7a5c58df385a7525a09161540c52539e2dc7530c6feeecb33bae0e0ae33ce6d834fe23fec0cba5f468a2df53c2ba12ca99e1b98776c49a20d6b045a05a16f5db81a60de25810ba952bab0720650fe158bebf88a52bd593161f3809cbcde5f899adbcd7ac5d2b45deb942bddaa37f88708bf89c4abc4b0518f014ab24997eb890c03d867551b361b35391f1206edd290a8de4310bbcabc005d23b026cb5", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000f6ffffff280f000000a4ea000300"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)

03:16:25 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x189)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  384.614098] binder: 16029:16035 not enough space to store 0 fds in buffer
[  384.632913] binder: 16029:16035 transaction failed 29201/-22, size 120-24 line 3475
[  384.647776] binder: undelivered TRANSACTION_ERROR: 29201
03:16:25 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  384.661666] binder: 16029:16047 not enough space to store 0 fds in buffer
03:16:25 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0xfffffdb3}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x2, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:25 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030b030303030303034303030302c757365725f643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  384.689263] binder_alloc: 16048: binder_alloc_buf size 7885081949402788504 failed, no address space
[  384.689270] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  384.689288] binder: 16048:16052 transaction failed 29201/-28, size 120-24 line 3284
03:16:25 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:25 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
r5 = dup3(r2, r3, 0xc0000)
openat$cgroup_ro(r5, &(0x7f0000000100)='cpu.stat\x00', 0x0, 0x0)

[  384.689457] binder: undelivered TRANSACTION_ERROR: 29201
[  384.705895] binder_alloc: 16048: binder_alloc_buf size 7885081949402788504 failed, no address space
[  384.705902] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
03:16:25 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  384.705920] binder: 16048:16056 transaction failed 29201/-28, size 120-24 line 3284
[  384.706225] binder: undelivered TRANSACTION_ERROR: 29201
[  384.831883] binder: 16029:16047 transaction failed 29201/-22, size 120-24 line 3475
[  384.850370] binder: undelivered TRANSACTION_ERROR: 29201
[  384.857679] binder: 16074:16075 not enough space to store 0 fds in buffer
[  384.857706] binder: 16074:16075 transaction failed 29201/-22, size 120-24 line 3475
[  384.864563] binder: BINDER_SET_CONTEXT_MGR already set
[  384.864571] binder: 16074:16077 ioctl 40046207 0 returned -16
[  384.940081] binder: undelivered TRANSACTION_ERROR: 29201
03:16:26 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x803)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001880)={0x54, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="06630440000000001163484000000000000000400000000000080000000000000000000000e3ffffff00000000000000000000000000000000000000000000000000000000000000000000ae174abfaa432884b9897857b163e2c290931f353d422b374e3183cf31bcdf542bbe77c49659ffd3b62409a9a101817da0a244522c783e6f90177ea1c3dd8190373de06e4d7b0129ff84f096e30b000000000000000000"], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000080)='net/snmp6\x00')
write$selinux_load(r3, &(0x7f00000001c0)={0xf97cff8c, 0x8, 'SE Linux', "09cb2024bb71d555e24201d314ea98bf156b7178968ea023e9ffa84a044add9b369858a52d2020787bf8933b72e256f37c274ad49cb4ae05f198d6eda7ef3049e0a33107182001521850b451ebf5b40391a9d83defd97aa8f24023fe1a2f76d91c39749187d29ed07434105da285c363b9d0731be8bb79c9718825bf8c86498f0a8e99563b974b5891aa"}, 0x9a)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:26 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000040)={0x0, 0x101, 0x3})

03:16:26 executing program 4:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x8)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x4, 0x4)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000300)=[@sack_perm, @timestamp, @timestamp], 0x273)
ioctl$sock_proto_private(r2, 0x89e6, &(0x7f0000000340)="84fe492fffa9dcf8fb8c3f30229ac7496a03b6b3807c63054e3696d031263040d6146e2e812b60877991b180f045cd3dc7bdf19ed7276d63f0602bf28b468563273eae563bba84ea45eaae0a8c86bf6d82486ad800426958f85cca9af41753082f4129b0b2e662285c13c7244190509be0d580ecc1a8372b2e29db1f63c0a06ace0680c70f2757fe11dcd50ae3a007d7c04956651aca6864e35b")
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r6)
setsockopt$inet_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0)='tls\x00', 0x4)
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
r9 = socket$inet(0x2, 0x800, 0x7f)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000400)=0xffffffffffffffe5)
r11 = dup2(r4, r9)
ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, &(0x7f0000000100)=""/126)
ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200)
connect$inet6(r1, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r12 = gettid()
setsockopt$inet6_int(r1, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r12, 0x0, 0x0)
tkill(r12, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)
fstatfs(r1, &(0x7f0000000480)=""/121)
r13 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r13, 0x0, 0x0)
r14 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r15=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r13, 0x400454ce, r15)
setuid(0x0)

03:16:26 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x803)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
pipe(&(0x7f0000000100)={<r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r2, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, r2, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x1c, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8000}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8ea9c06dc6e6d8f5}, 0x41)

03:16:26 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0xfffffffffffffe75, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1}, @fda={0x66646185, 0x3, 0x2, 0x2}, @fda={0x66646185, 0x4, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x1e7, 0x48}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
write$FUSE_BMAP(r2, &(0x7f0000000500)={0x18, 0xfffffffffffffff5, 0x7, {0x6}}, 0x18)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/full\x00', 0x800, 0x0)
setsockopt$inet6_tcp_buf(r5, 0x6, 0x1f, &(0x7f0000000400)="5478c069af22626f0724bbc3c22c17f19bebb9469adeb461deb08a1cee14684e7f38ec89c85532cbe197b71fae41e8e3056e3e4eb711069f84831fec1685655e1b4d0882ba4861568dfed93e37487520cd2f4d1b66f9b6f83601512ae0d71dd3bf7304bd3454f01b4b7c84db114afa8e96dd7c8200b91b8b85a2c1c078a1c7e336048970b319590cf346fdb27695d1602e90cb82c3892a5f02168fa8ee1f153a004d588f24561cc0a743aaaaf13414bc5304c845f06737fdf4b2b10a3d4ab0714e301f36f4d3", 0xc6)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00')
r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r8 = getpid()
fcntl$lock(r7, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r8})
listen(r7, 0x200)
ioctl$FS_IOC_MEASURE_VERITY(r7, 0xc0046686, &(0x7f0000000540)={0x1, 0xfc, "21f25ebcde40cc142e65786b00a4ed19701dd0985c983af8f84b55d378b36ac13c5a7c3c156bb587329d85de04929a0a648000cb0b53d08433e17646a3d23993a68b379c49e64bd33e66a4a66933adcd4e40f30570e440c444e25f81bb045280b39633bb5de93667a8673ed6bd3ddab8decdbfe30ec269a38b525b85295080ccbdd1e44af3de7dc6f7b5f66c627511bced864392d7d40f1b4d1d50b667c8fb2fa2fc60f988471774b7a86e5130f7287f35a9e30fb3f8f52e68cd00d95799d30f26e75e10a33375ee83e5b49e076803691c8f722ca3186f500457e40959e386643c5456cda973716f292f482ffa162dabbbde3a2012ee8bf4bf54fce9"})
sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x68, r6, 0x10, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x5, @link='broadcast-link\x00'}}}, ["", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x82)
ioctl$TCGETS2(r2, 0x802c542a, &(0x7f0000000100))

03:16:26 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  385.489029] binder: 16091:16102 Release 1 refcount change on invalid ref 0 ret -22
[  385.489523] binder: 16097:16103 transaction failed 29201/-28, size 104--395 line 3284
[  385.496255] binder: undelivered TRANSACTION_ERROR: 29201
03:16:26 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f0000000040), 0x6d, 0x503)
r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r6, 0x0, 0xfffffffffffffee1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r6, 0x400454ce, r8)
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r9, 0x0, 0x0)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r9, 0x400454ce, r11)
r12 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r12, 0x4024700a, 0x0)
preadv(r12, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$TUNGETSNDBUF(r3, 0x800454d3, &(0x7f0000000000))
r13 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r13, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r14 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x200, 0x10000000000000, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r13, r14)
r15 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r15, 0x4024700a, 0x0)
preadv(r15, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$FICLONERANGE(r13, 0x4020940d, &(0x7f0000000040)={r15, 0x0, 0x7, 0x3, 0x372})
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0})

03:16:26 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000200))
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
r2 = syz_open_dev$mice(&(0x7f0000004240)='/dev/input/mice\x00', 0x0, 0x0)
bind$unix(r1, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r3, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000043c0)={&(0x7f0000004280)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000004380)={&(0x7f00000042c0)={0x8c, r3, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x38, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4}]}, @TIPC_NLA_LINK={0x40, 0x4, [@TIPC_NLA_LINK_NAME={0x1, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x8c}}, 0x40)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000140)=<r4=>0x0)
syz_open_procfs(r4, &(0x7f00000001c0)='mountstats\x00')
r5 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x17, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000080520f00", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:26 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:26 executing program 0:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PPPIOCSMRRU(r0, 0x4004743b, &(0x7f0000000080)=0x2)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
ioctl$NS_GET_USERNS(r0, 0xb701, 0x0)
creat(&(0x7f0000000300)='./file0\x00', 0x48)
r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x1000f4)
r4 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f00000017c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000001580)={0x214, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1c8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc93}]}, @TIPC_NLA_MEDIA={0x50, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x852c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3a}]}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x784}]}, @TIPC_NLA_BEARER={0x48, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x9, @mcast2, 0x1f}}}}]}, @TIPC_NLA_MEDIA={0x5c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x88, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x209}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe800000}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf62}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ef592da}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}]}, @TIPC_NLA_BEARER={0x10, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}]}]}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100000000}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x4080012}, 0x40002)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = getpid()
fcntl$lock(r6, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r7})
listen(r6, 0x200)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="66643d6e70946f8e9d66a6231a090000000000000028c0cb4827fac7f5aa62da914bd686cab0a3dfa42d2736", @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRES64=r6, @ANYRESDEC=0x0])
sendfile(r5, r4, 0x0, 0x8000fffffffe)
write$binfmt_aout(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="cc0007051d000000b30300000300000005030000ffffff7f00000000000000008a1b9dc4a0eac42a8622dfc4f39f18c1700036aca3b450dc13200ec5daa32883616b4d64185e3eaa4b02ab8f982e09526c4239bbc58743f14392e19b3404e54f6b0ddca58b0191a77f3e413c33c928b6c3a8cb0fcb7c191414cd080770265aff4829c093303dd43a70582d77cfd2304e7990c89a2e146e4b43d8029e5a29081d38a6a11e2ba8a34d46063e4668d4852c1e14cbaefe8fe66fada5db2690bf45b1da6d262e0d852fbb01a4f6e456302c7067b54bf4589e7b37b12532dd8b171066258abe820219ffe6775686a2f20a6270ce011717d1b0da182a5f440ce3fdf616b65d523481266a3d44b26a2f48f21a0401c5e597b8bfc7986c704469bfe332f665e8d5ba393faf2d9d9ad0a9476bc576c4c911dee4016009e8827d1569d9579178f7cdf32642b13f619779505a50a7686b1fc75251f15d29145b3cf5d92c1e9d1c14ba060cd11204250997334164f78e60a12d7e4d610383c2c3a734f608e4a98f02f25778ffc3040f3c1ce57e582e52ffbc244c881e5b25bb45d96f11f374a416554553168724889dd4b59a1baa2ebc5fb15a6139029177a8c475b7b88a305e00a8f2daefd116abbef10698122f5b3c31acd6e092c1e1fc6091412280ccc68d211c84f19663656336d10c73f3e8f710757f5a6ee0ebf6426560fbc63e0be3020010c8aa3fad1366ed4c3426d63c57a73f05c9b2811add90bab21d94fd2b5a2eef09cc4bd72152a5fc81a20469b2b7c25a986a5d2ea2945a669f40741979b18c86415167a9101bd4f0530105fa09487ded1a939050b7060ca55d628d1730f6c079cc7b178110a3fac1faa4856ece47bf6dc79d6abea16a646d8befd824c71581aafd65cd69128c89a6a1879ad30fc954a9c6af950bc9dbd6251d02f788a7db90be4d213caac6c9a62867d5719d1a46e1e74f110ada5978681a7e6fea9f01fa9ac93b56e662cbaa10b6ea00a881e041f407cbb7be5608e52b79c7f976bf6d2fa466f13f071d67fb51548d0911f5b11a3f1eeab6b30604aea93b386f679cfb052fb7169d861683393c48a4a7639ac4370116cbbfc73a251cc00cc972c4e61bed31146533d637b1d5df35b09774c4299cc1e43bfe25e9535803cb2f5e2d1c7a19dc4d181a6c772d890cb0ed42327e7be9808d9d592218842846343560e403f120fedb3f4e15b6baf44abe108dab803234f7855f6334d648a80f6b06636468a1c5ada74381d6a96ecf07fe3d353643ea3ed94bbcdc49cfc91b750c23b7f0742ba0424c76bad5d8bd083d6d9f6d5c47300f47af859f722d08f0de01655daf9ebbb863f6a2561edced5e9e71b2b2b14e96905a3bf7baa348654f6cd35e1ef7b1668ad0f6f92230bd1a0df46795ac78cfedbf2e618a3ec726798db7972dfc1a046a553195633dcd3a2b8d4c7df1d38a11cbb764e11277d789a8fbe200bd5b60edca2238aa09a6ae9851d0dbb2126185f442571eddeb46c69819ad357177d318408bb6bdde682c94894fb78fd5d7a25215138b8e5ca787fb586d6fee6cacb3803d627de991564898cf2cea1693695b36215b985f04a4f2d02f944aaffddca48ad6da60230152aa3a5529eea5900d0acd171f631f4512a1b0793dc836a73fb24eaff576c41b9c24865aeb9e0cc80d29b1fabca98e5ce0060a8cdec9ae9acf2c858d3df088132b9d2083d103b1d8a6ebcb7de57b252a930c15c04751cc2a608ad67964183a57a1c424b6d4eff50d5af9f2067bbb3397a58f2ef999f033126a8c351fab7d7d7b82c6e88def1fb61e6c9f9a344a4b3d81a76e1827b393a8cbeddc728c0c6581a037f8daa233b8b2cc0166dd412ebf290361c7fdb67d7c4aa2ab8921f223e6bd101cf2632d936a02c37a88c9c95bcbd5a8951c339838f9f3c7443f3f4e1b4342a5f92e9e7e91a9b89214104e45756494b5501e82beececf6e0052e42520f8dadc5377b2a810473805f945069b4729c455eff78948eae2dbad4ef3b264830fcb1385f7f18dd024a7924e97230ca9976046174bf3d0a8332d24128f22da31abb84ceabf5bdc5812988be277aacb7c23575e8765f74692ce16eb73c0b536c42922369ac69b5838f4e50095f97cdc1b73d63f634eb94edd149fb19c54b6d1ea7bd07aa527a67eb02d65ed280c7d4662ef32c031af5f4f17ecd211b7b1b3d56ecae41dfd7c54b058552045a7d9f2b091c66a1785adb403ff19f8b10ebf81743cbffb62326918417c472e4e04f23590eb25248484fe418dcbb4b0230bf948c331f8c6038e562565e268477e59bcf500b068024541dd0b7467a73aa75ee75fe1968ae0e9d5bffb6d48fc79f08418b2284a92e6a980bfe13432f3ae5f733ac90f56a307bad8b9301e3453d02927742513ad3be5859bf5ad8864df1b725d86aaf934882075aa90d8e69f59ac53c9d5e13883b7abf29c17c25521030266463b2518718e536c892b1b49e58d1727cc2092273d062d7350a5ce2f34bc6f58fbbae47c2377b58001aba45808cdd120943774529c7351ae7b15d0746b5b0712efe05541156b70658a13b79c6f42fa6c706479923d112d8d5ebec869257517d65e454188f2156be433d7e92152ee6ace609deff93feff975bb2558b1d07f7844e6d8542058c30cdcb0e387108fc71696ecf5ac8d77f5c0d08a7fd8a0af1ce5064c10e5b5d7087205c4cf773eaff2d40abdccbb62dd892b1706459b53450d9694a92637d466b673f878a6f2ca7ae32fd5f7ffd76ecc03fd810cabf2c39dd380546d1b7906c7e156352875ed969300584cb3626af25f7dc3858782ccb7a56eb7acb6adfb02315e940f7a4ebfe29c69090bbb5cc66c4245d443640273f62cb12a662b780fdb6309510c45ae76c5939cd08eee9515370829a37b52339e53dc4ebdf01ec79e0383bddcdbf58c4c9b25f1f3afc701a5fe54c04c5dd6e22896f3d6e98a9abbd1647cc9f7db715a4a5a862e7e2d35ab4dcb5f57b843fa16f16e1a75bddfdb115cfcc844df22ed16c635f2aff723177fca65006a9e9d619418df366c9051541eb71f8b934e8c00329f0d51d8de58a0db0b585c13be5cdf3020f5df628ce04ec1777c312007b388d3664898a3e2ba4f40f812c8eb5d701e8707aa734b9b86eeb713098b3af8e6ba34ce7f2b062bdf40c3095782178be73201d52bd541ea01522c296eca26980233fa553ddda7b7241343f17d3067994572f005a42f5f4bc578d635a5180814cf5b82e2d64ab87c46846c1d1f59f0bd0c9410b859fcea51ea409232411c9db5a918da987d6f4eac349b180c163409586da4ec1b963789bbc9910f956d9a575c54202c132ba96a2d24bfa33d5fc7e94322e6bb3fc771adfaaecf5cd843e8d2b86e02294bbdcd737178b45744d4b258568ac7452f841713442e976a1c3dc6aed5a46de5ff63e6594c80a69524129fe11d5233aca1d207be5942d243082c85e9627d153865a61da5c0d221c7c38ce81553ef9caa2654a3671480aa3870e80c4ea672d8d0678712c83263db1f0fe60667ebec6ddab48585c1e3217bde3b0f2862920bbfd2b0f210eb8dfae717f321e0dffb5789629a4811e86583ef76118a98576deed0d635134ab40861fd5d3cec290080cbb215fdc5f610b06c1de328211ceb0d58ff67ae8bea51576d53576a13a751b63b86bf7d98d5ac020eaf8d7779e9b980eb3a6c917a5dd44059c4a330f3f199c19b0402c87c24b51579eb1be573341b4d55a6ece7f0f1d7d97933d483d07d8c4e0a91a07d280c7b639040525ad8828f244c0713d045861ab30b303d68610e030cac96868cf34adfd3d73c7809a0dc87bc8ebc8df7280075eb8eee100e67744e2d5c8416a6702bcb759bf38ec48bc1c748310662e018f4aa9a3bf0649d8142aadc1816e1bf9de3a3198672823e8b7954e3fc2efcd8166e642a93fc77269712d6bf714be0d88054adcbdccc5e842451f883843aefab32fbf4a2b4d4e798ea75e5d78c75e870b86ed64ae7191056c82711e74b00809528cc21eff12f274aba48a8c24f6ad48383cdc452b9897cc6344a3f63fa25dbfd5b409cd01542a0fab7d1830f03db4010b0c99999b9300a48490c16591d1df6e90324a10ba9d6082b4f73e127d1765f46d4db43c22a0b6625a06e232566d53a2ddc76a8b00eb84c689ee1eafcd92822aa17cf31d4440ad59b02b85a672cd8a9b2265d67f4938a69d7d18a2fbaa349fc5568c60b14aadbc663f74a2cac3f75dfc463f39d4439e3385386e428520f8625f7072c38d921a60ca25430184f4a0e164595e72023b02ba6a4ce7c96a72798c0dedfd4b7a6fcd70493ac708553d4b9a186e626257fed948feb7c49a5d8203e51445eaa00754ced45cfa5292c68a05cdd6f9370914a260628f66d20130e5525b5062aeabf436bcf6a36632cdab482222bc6a46f5bcf49c18caeb7044596fd5cc0140f33b610cf9b642b931f4f61dfea10535b74c20b97066ce671599cd21b331bccef23e50d198d0e39482a814a274914db213622a115716589cd02245ebc1652d2f38888b75f8c3fb6425872c63735c99cf7ec1f9ba8e73bc99cac89f56b3f9115e6eb72e1efaf6fed0becd785518021ed47409f74488f6fa6d18388274ddfe307c0ef573d848c4e10d60608645913666b7d11ef44096f0e7da0674cc4d5c08b098075cb07603835578156292563b59fe8ef55b036851cd57c07ea9dd1d7eb5011a2b1abb1637c691bbd4381e6de831e7a3909344c65a18ad7024005447f821c7b53468a17cca834a47fb2141f2d41fdcb648f05534fd2f6014939dc5bf062faac2b423b288ba855a0f0bf87c9c1dd07f30ff3d66ae5a7244ea178e6cbd7b85ac8b231bfb914a76d351d8330d7d29bc834990103d63c40c7b871e0ecd0a4fbcca898f598dc3a924799d40c761e848803ae239058ae09f086f797d55776a177467a669185c8cba33f84d5a305a7036218944a87e71cb7e7dabf60ed04a8fba0c706c88b02b97fbeb5101504b8ff0c87fdcf7e799f65f5d0e4dcf2c102e19c7bcd7e3abef6234edf0a0135face699d8f82b166f86a5e81da0006d1a100dc7f500af8beea7a5b124b70dcb63496dd47b7bfc4054005d5a4abcfefffd595916cf48a159671d265e27253ef072a9f4f4295d7a252837a4a43735cf31106693bb7ee20dd902c25f22a4476a271ce8da10591f9e0d240b228bd1b83c1fa9687a7f8231166ad107923583b66d977cde19728a527fe39438bd5bf3d9dda55308185fd97a1f31f58446fa596773ad54c956ef2c0c27117e4b4d2adb730feae2993637b44ac02d1e9a118396e2c1a06e7372750c1caa1ef289d1cdf3899a0de628510da2f2ef7b82f84f0a9c61112d9f2373bf2108bf83ceb3c283ae5487212396365055f5af1480730fee23597373565973a175618c55a4a4a9f1a8aa896adbfe039a93e95699cd9da4a0df1c70be3a926625ca13d42495e5ec2ea71e252504e5be4ad3abf80a36c8d9a61f2cca5f60839eea4c36ff73775c5ebc4f0eff44643ef751fcdaf68182d8ada7278cade494a3bdce147d700335052bb1f0fc07e8d1fa0659c55b3aca28e021595262741057c8d663b169d5a6fd15cded4d31269197d02612935107b34c36b488df3e21d9c794fbed7fb63167224ab84429b97c074b1a885d1fd7cfdb3431d408af36831ae25f365408337bc06b85496bf5dbccd92fdb31eefbb9a8ce3aee1b1b44c6da7341f3a67bca253c7f8cc05c141717e92f3b6c2dc27beb914edd5c776ba728f2c8e8857e7fd18fd7e81a0a53aef792d3f1c8cec38b16dd07f56e01316325a1f8e49a356f39bb1d2efe173e69231d8a127f8f852200"/4640], 0x1220)

[  385.503563] binder: 16097:16106 transaction failed 29201/-28, size 104--395 line 3284
[  385.505111] binder: undelivered TRANSACTION_ERROR: 29201
[  385.549180] binder: BINDER_SET_CONTEXT_MGR already set
[  385.549190] binder: 16091:16116 ioctl 40046207 0 returned -16
[  385.614989] binder: 16091:16102 got transaction to context manager from process owning it
[  385.624817] binder: 16091:16102 transaction failed 29201/-22, size 0-0 line 3129
[  385.634071] binder: 16123:16128 ioctl c018620c 20000200 returned -1
[  385.634198] audit: type=1400 audit(1572146186.327:57): avc:  denied  { transfer } for  pid=16122 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
[  385.634240] binder: 16122:16127 got transaction with invalid parent offset or type
[  385.634281] binder: 16122:16127 transaction failed 29201/-22, size 96-24 line 3454
03:16:26 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0)
sendto$inet6(r1, &(0x7f0000000140), 0x0, 0x4000044, &(0x7f00000001c0)={0xa, 0x4e24, 0xfe00, @local, 0x800}, 0x1c)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:26 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:26 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
sendto$unix(0xffffffffffffffff, &(0x7f0000000040)="5540baa4", 0x4, 0x4, 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

03:16:26 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_pts(0xffffffffffffffff, 0x100)
syz_open_pts(r2, 0x100)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  385.635072] binder: undelivered TRANSACTION_ERROR: 29201
[  385.705232] binder: 16123:16137 ioctl c018620c 20000200 returned -1
[  385.732116] binder: undelivered TRANSACTION_ERROR: 29201
03:16:26 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:26 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
prctl$PR_GET_TIMERSLACK(0x1e)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x671713e66eecf39e)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x41, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000002000000900000000000000000000007800e10def0000000020001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000001280000000000000050000000e8ad7226"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  385.768257] binder: 16140:16146 not enough space to store 0 fds in buffer
[  385.771872] binder: 16144:16147 not enough space to store 0 fds in buffer
[  385.771896] binder: 16144:16147 transaction failed 29201/-22, size 120-24 line 3475
[  385.772025] binder: undelivered TRANSACTION_ERROR: 29201
[  385.832497] binder: 16153:16158 not enough space to store 0 fds in buffer
[  385.832524] binder: 16153:16158 transaction failed 29201/-22, size 120-24 line 3475
[  385.832658] binder: undelivered TRANSACTION_ERROR: 29201
[  385.848671] binder: 16153:16164 not enough space to store 0 fds in buffer
[  385.848954] binder: 16153:16164 transaction failed 29201/-22, size 120-24 line 3475
[  385.849226] binder: undelivered TRANSACTION_ERROR: 29201
[  385.939175] binder: 16140:16146 transaction failed 29201/-22, size 120-24 line 3475
[  385.949583] binder: undelivered TRANSACTION_ERROR: 29201
[  385.955372] binder: BINDER_SET_CONTEXT_MGR already set
[  385.960738] binder: 16140:16168 ioctl 40046207 0 returned -16
[  385.966890] binder: 16140:16168 transaction failed 29189/-22, size 120-24 line 3138
[  385.975033] binder: undelivered TRANSACTION_ERROR: 29189
03:16:29 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0)
ioctl$UI_SET_PHYS(r5, 0x4008556c, &(0x7f0000000040)='syz1\x00')
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:29 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x56, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="112348400000000000000000000000000000000000000000000000000000000000000000784000009552000018000048dbd64100", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYRESHEX, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:29 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:29 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
unshare(0x2000000)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d39c0eada30303030303030303030303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
write$smack_current(0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x1)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:29 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r6, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
r7 = geteuid()
r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r9)
chown(&(0x7f0000000000)='./file0\x00', r7, r9)
setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@empty, @in6=@loopback, 0x4e23, 0x0, 0x4e22, 0x5, 0x14, 0x20, 0x0, 0x3b, r6, r7}, {0x6, 0xffffffffffffffe0, 0xe5b, 0x8, 0x4, 0xfffffffffffffffe, 0x6f02, 0x3}, {0xfff, 0x7, 0x7, 0x5}, 0x3, 0x6e6bb4, 0x0, 0x0, 0x1, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d6, 0x33}, 0x5, @in6=@empty, 0x3502, 0x4, 0x2, 0x8, 0x100, 0x7ff, 0xffffffff}}, 0xe8)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r10 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000000000000005"], 0x0, 0x0, 0x0})

03:16:29 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:29 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:29 executing program 0:
creat(&(0x7f0000000140)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000080))
fallocate(r0, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
ioctl$TIOCSRS485(r0, 0x542f, &(0x7f0000000040)={0x9, 0x7fffffff, 0x7})
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="66643d04b2ba93a11d863f3b03b44b48bba4e3c5a9c92e516beab319b4b5b57a008b14f06858fd2762556fa643cd5a1a4ee03bf75fcb54db56e1087fd7409ae5a5c449f11e4b9a98211dcf46bfddf91cd315593db493da5f009f944fae8f3ff8ff301a55971fe84c6d2a1d40fb054d1de55d98318b00e3b26e406f1aab44bf0762ff0870fe14811c874ce12fcdc5157c4bc5be6e6bc5e9423e53", @ANYRESHEX=r3, @ANYBLOB="2c726f6f746def64653d30b90900000000000030303030303030303034303030342c757365725f69643d7222764d5e8d04d0bd59881ad66d12c2", @ANYRESDEC=0x0, @ANYBLOB=',\b\x00\x00\x00p_id=', @ANYRESDEC=0x0])
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x0, 0x500)
sendfile(r4, r2, 0x0, 0x8000fffffffe)

03:16:29 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffa000/0x5000)=nil, 0x5000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  388.602806] binder: 16172:16176 transaction failed 29189/-22, size 120-24 line 3138
[  388.623684] binder: undelivered TRANSACTION_ERROR: 29189
[  388.627371] binder_alloc: 16173: binder_alloc_buf size 360287970189639824 failed, no address space
03:16:29 executing program 1:
socketpair(0x3, 0x1, 0x0, &(0x7f0000000100))
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x7b, 0x1}, 0x7)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x115, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000007800000000000000930000000000001c610d2ceef895c59a75c53447ca0e39a9b7eaa906fa6915970100000049335cba2a98ead0e83c465510dcdbdf1844ae69065f4c27f96ea6e8f07f0e199cef5412c9cbf1f117ceaf62d323ced22e7b6701b5b37f720b5b09a6ceeb7acfa28d06b151f4e4322940161ab1272e24507cd06c08e0f0dde14a20cf5df4aed39d37cae8c295c3443bcbae0eac6ea29866e37620f91e44a08f2cff074013e0014966ef397ef42fab8aa3b3c45781eb4309bd5b7168666d5fed0284605f51", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYRESOCT=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:29 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  388.627378] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
03:16:29 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fR=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  388.627394] binder: 16173:16177 transaction failed 29201/-28, size 120-24 line 3284
[  388.659190] binder: BINDER_SET_CONTEXT_MGR already set
[  388.659198] binder: 16173:16177 ioctl 40046207 0 returned -16
[  388.710090] binder: BINDER_SET_CONTEXT_MGR already set
[  388.710097] binder: 16192:16198 ioctl 40046207 0 returned -16
[  388.710548] binder_alloc: 16170: binder_alloc_buf, no vma
[  388.710568] binder: 16192:16198 transaction failed 29189/-3, size 120-24 line 3284
[  388.719143] binder: BINDER_SET_CONTEXT_MGR already set
[  388.719151] binder: 16192:16202 ioctl 40046207 0 returned -16
[  388.719366] binder_alloc: 16170: binder_alloc_buf, no vma
[  388.719382] binder: 16192:16202 transaction failed 29189/-3, size 120-24 line 3284
[  388.749075] binder_alloc: 16196: binder_alloc_buf size -5542407243834987576 failed, no address space
[  388.749082] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  388.749098] binder: 16196:16199 transaction failed 29201/-28, size 120-2017612633061982355 line 3284
[  388.779963] binder: BINDER_SET_CONTEXT_MGR already set
[  388.779972] binder: 16196:16211 ioctl 40046207 0 returned -16
[  388.930985] binder: undelivered TRANSACTION_ERROR: 29201
[  388.936621] binder: undelivered TRANSACTION_ERROR: 29189
[  388.942131] binder: undelivered TRANSACTION_ERROR: 29189
[  388.947895] binder: undelivered TRANSACTION_ERROR: 29201
03:16:32 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0xc, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:32 executing program 5:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
r3 = openat$cgroup_procs(r0, &(0x7f0000000100)='tasks\x00', 0x2, 0x0)
ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=<r4=>0x0)
fchown(r3, r4, 0xee00)
r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00P\x00'/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:32 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:32 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000100)=""/126)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xcd508277d406e80f, 0x50, 0xffffffffffffffff, 0x662e0000)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000038000000000000000000000878000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:32 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000340))
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x40)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='\x00\x00\x80\x00', 0x0, &(0x7f0000000280)=ANY=[])
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r5 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r6, 0x0, 0x0)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r6, 0x400454ce, r8)
r9 = perf_event_open(&(0x7f0000000400)={0x3, 0x70, 0x7f, 0x7, 0x40, 0xa1, 0x0, 0xef3, 0x400, 0x3, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, @perf_bp={&(0x7f00000003c0), 0x8}, 0x40, 0x7, 0x9, 0x4, 0x9, 0x8, 0x2}, 0xffffffffffffffff, 0xa, r6, 0x3)
sendfile(r9, r5, &(0x7f0000000480), 0x710)
r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r11 = getpid()
fcntl$lock(r10, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r11})
listen(r10, 0x200)
r12 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="d6be7520b97c545e83a7e44d59872d52fc7b599888617fd71a4c8b3abc402e6fe8b72e4b9f9728288d87c462f1c28f67a6c5240f89c0dcdcd72e1f5c18ba", 0x3e, 0xfffffffffffffff9)
r13 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r13)
keyctl$unlink(0x9, r12, r13)
fcntl$getownex(r10, 0x10, &(0x7f0000000040))
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:32 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
r4 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x163, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0})
r6 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000012c0)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0})
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0xd8, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0xa, 0x2}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r6}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@fda={0x66646185, 0x1, 0x0, 0x7}, @flat=@binder={0x73622a85, 0x101}, @fd={0x66642a85, 0x0, r8}}, &(0x7f00000002c0)={0x0, 0x20, 0x38}}}, @increfs_done={0x40106308, 0x3}, @dead_binder_done, @clear_death={0x400c630f, 0x2}, @acquire_done], 0x28, 0x0, &(0x7f0000000300)="e970183125049fb885d5a028a1b07faa5afff0e2277063991889d369f779d61e3ba458be643ce873"})
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r9 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:32 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x7, 0x4, 0x638, 0x218, 0x338, 0x338, 0x550, 0x550, 0x550, 0x4, &(0x7f0000000100), {[{{@uncond, 0xf0, 0x218}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x9, 'system_u:object_r:semanage_exec_t:s0\x00'}}}, {{@uncond, 0xf0, 0x120}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x200, 0x1, 0x8, 0xfa88f0cc3895b658}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x10}, @broadcast, 0xffffffff, 0xffffff00, @mac=@broadcast, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}, @mac=@broadcast, {[0x0, 0x0, 0x0, 0x0, 0xff]}, 0x1, 0x9, 0x9, 0x9, 0x4, 0x5, 'yam0\x00', 'caif0\x00', {}, {0x1fe}, 0x0, 0x20}, 0xf0, 0x218}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x90d2, 'system_u:object_r:hald_keymap_exec_t:s0\x00'}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x688)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="116348400000080000000000000000000000000000000000000000000000000000000000d4bc23304722fb531800000000000000343a4d08e4f912eec85de3e2", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:32 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:32 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:32 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
setxattr$security_selinux(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='security.selinux\x00', &(0x7f0000000200)='system_u:object_r:nvram_device_t:s0\x00', 0x24, 0x3)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
pipe(&(0x7f0000000100))
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00dd000000000000"], 0x0, 0x0, 0x0})

03:16:32 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000856164660000000000000000000000000100000000000000140000000000000066cae4737f0f4aa88fa757081ac6b797233450104600e270fbeb642a4fe7c8227771523d89ccb961b61cf7df0ac26e02719cfd340a78e74968db82c75fd7d2498560d16772e7287b80c2c4a3be0f6567af455a016b08d267b73f35a7ae16f72ec8367cc1aaa73d0977e387b747299c737b0584eda288283d85ae0f79735ca2a929e8657f3a4d12e5819d0bd037403033d6e9"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  391.621760] binder: 16217:16220 got transaction with invalid offset (5764607523034234880, min 0 max 120) or object.
[  391.634380] binder: 16217:16220 transaction failed 29201/-22, size 120-24 line 3379
[  391.653642] binder: undelivered TRANSACTION_ERROR: 29201
[  391.656090] binder: 16224:16227 got transaction to invalid handle
03:16:32 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  391.656098] binder: 16224:16227 transaction failed 29201/-22, size 0-0 line 3138
03:16:32 executing program 3:
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, @fd, @fda={0x66646185, 0x0, 0xffffffffffffffff, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}, 0x2800}], 0x0, 0x0, 0x0})

03:16:32 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRES16=r2, @ANYBLOB=',rootmode=00080000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="020001", @ANYRESDEC=0x0])
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x5253a966ef325efe, @perf_config_ext={0x1, 0x50}, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f0000000140)=""/122, &(0x7f0000000040)=0x7a)
syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x1, 0x4000)
sendfile(r3, r2, 0x0, 0x8000fffffffe)
r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r6, 0x0, 0x0)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440)={<r8=>0x0}, &(0x7f0000000480)=0xc)
r9 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r9, 0x4024700a, 0x0)
preadv(r9, &(0x7f00000017c0), 0x1fe, 0x500)
perf_event_open(&(0x7f00000003c0)={0x0, 0x70, 0x2, 0x2, 0x4, 0x6, 0x0, 0x367, 0x2050a, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x20, 0x4, @perf_config_ext={0xffffffffffff7fff, 0x4}, 0x100, 0xac, 0xffffff81, 0x0, 0x20, 0xfffffffd, 0x1}, r8, 0x0, r9, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r6, 0x400454ce, r10)
readahead(r6, 0x8, 0xda94)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x14, &(0x7f0000000340), &(0x7f0000000380)=0x10)

03:16:32 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000edff00000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000856164660000000000000000000000000100000000000000140000000000000093213d4aec0e438fe273fb75ac2991cc359c9be2c272f70d7910da90e594ba863e02e72357f5a9cf5b52f35e716d14b9805399ceccf2383670cb3eeb2e335cc8eb1b20f425f3fbc822c24a1c3e158bfda6d167de74fe1011d19dd03b67281012b79d2afe19dd35a9c1e1a55f8a7841099c78f6a57e8f32f7a8cf56e0ee1edb8caebec3d8173313ab99cd34f3377e1668a53c4e08fd844aa79a57d5a44efca10397e410783c2a1fa1fe2ca8b4565323cecfdd3c84a63ae15dce967b674bb9c88cd49b7a94dbe91473e5a844e64d07fa2ea5b493990666ab364b3c068836430a0000000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  391.656634] binder: 16224:16227 BC_FREE_BUFFER u0000000020ffe000 no match
[  391.658013] binder: BINDER_SET_CONTEXT_MGR already set
03:16:32 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:32 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:32 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = getpid()
fcntl$lock(r1, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r2})
syz_open_procfs(r2, &(0x7f0000000000)='ns\x00')
mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x8000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x404)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a747000000000000000000000000081feffffffffffff00000000000000000000000000000000852a74700000000000000000000000003f0100000000000000000000000000001b00000000000000852a62730b0000000100"/104], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000000000000000519c305deac619b6441c4aa5fb83d8526abec23cdd4c384ec843f08ed3271c4d892c2ef8da752ad4e2922144ad576a8ca14ac8842f236a687e1b7609f0d5d5e3baeeb2090000004fca88b5d6b0421ee3dcfcdde4e27b764be5ffd710f72cae6f7e6b81e33e6053681dc72e2b46c9f739b5a6e8ca678c6b3a90e264ffae430690c2d9917170669d2f214299c5aa86c1887b60029b143410fe71b0707babb9ee25807dd6f1d02a62b4a9038f63b7416a63fc86430ab4ec29fd7c0d121dc95bf6971ab1ca935de2ec7ffb8adc5118a21ada1317b9e38e22dc09690e884d087d3b36d556a985334f9c0e271bbe55ea35d933064e13600d86dffc6bf1c75015a144f8c2676e4818fa757e30386b992077181183810d591c61c44c0000588d48252d5e5ac9ff33419d3be69a304b42c735a035632b6ee3b99bac711be3588ea51430dfb45d7d5110996e58946dae6e6508db63be08234a6ba9db784779aec875328e75c911d819f9aca04f4456a4f5bdc4d824a8d0eb3be49e0fb71f03cf94c5983c4c8bf942a3b68adc8e0e0db305972a5e92b6cef517a17e8defd8152cf53f89144ffc7c2fef10836cdd8bf9ffa8294a56dd6effd4c3ca09f8001ed8e53d51ea8cb46b859ea4a6bcfc59c41231a703983aa3ac3440fd727a639eb27d1b1144dbfe3e4829e3ed84f5f75b783c2ed253140e3d3bbd31e32649429687417da2afccf47c9f095fc01868ce418b9f6a9f79c9cef97f7d676e15c98754bdccc38b722bdf9c5564c887aefc854aa09ddd1cba30b7a40bc1a8ce3d00afc5261e42fd861be0f051b2a75e1167c2f091fe177ec14346f0071d8246160fc7"], 0x0, 0x0, 0x0})

[  391.658019] binder: 16224:16227 ioctl 40046207 0 returned -16
[  391.658841] binder_alloc: 16224: binder_alloc_buf, no vma
03:16:32 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0xf71180d8a24707e6, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  391.658857] binder: 16224:16227 transaction failed 29189/-3, size 120-24 line 3284
[  391.660370] binder: BINDER_SET_CONTEXT_MGR already set
[  391.660377] binder: 16224:16231 ioctl 40046207 0 returned -16
[  391.660530] binder: 16224:16231 got transaction to invalid handle
[  391.660537] binder: 16224:16231 transaction failed 29201/-22, size 0-0 line 3138
[  391.660713] binder: 16224:16231 BC_FREE_BUFFER u0000000020ffe000 no match
[  391.661532] binder: BINDER_SET_CONTEXT_MGR already set
[  391.661539] binder: 16224:16227 ioctl 40046207 0 returned -16
[  391.683607] binder: BINDER_SET_CONTEXT_MGR already set
[  391.683615] binder: 16217:16220 ioctl 40046207 0 returned -16
[  391.691524] binder: 16232:16237 got transaction to invalid handle
[  391.691532] binder: 16232:16237 transaction failed 29201/-22, size 6051468213448064212-24 line 3138
[  391.694746] binder: BINDER_SET_CONTEXT_MGR already set
[  391.694755] binder: 16232:16240 ioctl 40046207 0 returned -16
[  391.696061] binder: 16232:16240 got transaction to invalid handle
[  391.696071] binder: 16232:16240 transaction failed 29201/-22, size 6051468213448064212-24 line 3138
[  391.733547] binder: BINDER_SET_CONTEXT_MGR already set
[  391.733557] binder: 16241:16246 ioctl 40046207 0 returned -16
[  391.734864] binder_alloc: 16224: binder_alloc_buf, no vma
[  391.734883] binder: 16241:16246 transaction failed 29189/-3, size 120-24 line 3284
[  391.741462] binder: BINDER_SET_CONTEXT_MGR already set
[  391.741471] binder: 16241:16246 ioctl 40046207 0 returned -16
[  391.741973] binder_alloc: 16224: binder_alloc_buf, no vma
[  391.741992] binder: 16241:16250 transaction failed 29189/-3, size 120-24 line 3284
[  391.754445] binder: BINDER_SET_CONTEXT_MGR already set
[  391.754454] binder: 16244:16251 ioctl 40046207 0 returned -16
[  391.754698] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.754716] binder: 16244:16251 transaction failed 29189/-3, size 120-24 line 3284
[  391.778834] binder: BINDER_SET_CONTEXT_MGR already set
[  391.778843] binder: 16244:16256 ioctl 40046207 0 returned -16
[  391.779721] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.779740] binder: 16244:16256 transaction failed 29189/-3, size 120-24 line 3284
[  391.832482] binder: BINDER_SET_CONTEXT_MGR already set
[  391.832490] binder: 16264:16268 ioctl 40046207 0 returned -16
[  391.833042] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.833060] binder: 16264:16268 transaction failed 29189/-3, size 120-24 line 3284
[  391.844375] binder: BINDER_SET_CONTEXT_MGR already set
[  391.844384] binder: 16264:16269 ioctl 40046207 0 returned -16
[  391.855132] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.855150] binder: 16264:16269 transaction failed 29189/-3, size 120-24 line 3284
[  391.883288] binder: BINDER_SET_CONTEXT_MGR already set
[  391.883296] binder: 16272:16277 ioctl 40046207 0 returned -16
[  391.885774] binder_alloc: 16224: binder_alloc_buf, no vma
[  391.885791] binder: 16272:16277 transaction failed 29189/-3, size 120-24 line 3284
[  391.892396] binder: BINDER_SET_CONTEXT_MGR already set
[  391.892405] binder: 16272:16279 ioctl 40046207 0 returned -16
[  391.894049] binder_alloc: 16224: binder_alloc_buf, no vma
[  391.894065] binder: 16272:16279 transaction failed 29189/-3, size 120-24 line 3284
[  391.923983] binder: BINDER_SET_CONTEXT_MGR already set
[  391.923991] binder: 16276:16280 ioctl 40046207 0 returned -16
[  391.924227] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.924244] binder: 16276:16280 transaction failed 29189/-3, size 104-24 line 3284
[  391.934627] binder: BINDER_SET_CONTEXT_MGR already set
[  391.934636] binder: 16276:16284 ioctl 40046207 0 returned -16
[  391.934856] binder_alloc: 16217: binder_alloc_buf, no vma
[  391.934875] binder: 16276:16284 transaction failed 29189/-3, size 104-24 line 3284
[  392.361061] binder: undelivered TRANSACTION_ERROR: 29189
[  392.366631] binder: undelivered TRANSACTION_ERROR: 29189
[  392.372195] binder: undelivered TRANSACTION_ERROR: 29189
[  392.377839] binder: undelivered TRANSACTION_ERROR: 29189
[  392.383425] binder: undelivered TRANSACTION_ERROR: 29189
[  392.389141] binder: undelivered TRANSACTION_ERROR: 29189
[  392.394699] binder: undelivered TRANSACTION_ERROR: 29189
[  392.400277] binder: undelivered TRANSACTION_ERROR: 29189
[  392.405884] binder: undelivered TRANSACTION_ERROR: 29189
[  392.411443] binder: undelivered TRANSACTION_ERROR: 29189
[  392.417067] binder: undelivered TRANSACTION_ERROR: 29201
[  392.422672] binder: undelivered TRANSACTION_ERROR: 29201
[  392.428329] binder: undelivered TRANSACTION_ERROR: 29201
[  392.433890] binder: undelivered TRANSACTION_ERROR: 29189
[  392.439980] binder: undelivered TRANSACTION_ERROR: 29201
03:16:35 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
ioprio_get$pid(0x2, r4)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:35 executing program 3:
finit_module(0xffffffffffffffff, &(0x7f0000000100)='/dev/binder#\x00', 0x1)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140)={[{0x0, 'io'}, {0x2d, 'io'}, {0x2b, 'pids'}]}, 0xe)
ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000080))

03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = accept4$unix(r2, &(0x7f0000000100)=@abs, &(0x7f00000001c0)=0x6e, 0x80800)
ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000200))

03:16:35 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c677d6f75605f69643d379020bffb6ec43cc506c32101714d90aca08d89f36a3fd9f3b29dd203e2c2a6065eb48aa4cbfd17e02fd344aa1ae9a6b287d5ed888a9b2be64aefca1abd2446283dccbce55b247a28542531b9f9e2ac836418546660bd1cae6e8114aefd8474f7db8da20e4cd9f96e18fd88f220e7b2d45e50ebd6bbf65c7ba9bde87f2b195dc4dc328d36935746dd1cd73d7f4876728c0a738c7645eecde1ed", @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 1:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00')
getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@delneigh={0x0, 0x1d, 0x85af9aaf408abf4b, 0x70bd25, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x8, 0xb}, [@NDA_SRC_VNI={0x0, 0xb, 0x4}, @NDA_CACHEINFO={0x0, 0x3, {0x6, 0x7, 0x2, 0x9}}, @NDA_SRC_VNI={0x0, 0xb, 0x5}, @NDA_DST_IPV4={0x0, 0x1, @local}]}, 0x2c}}, 0x0)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e20}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @rand_addr=0x65}, @FOU_ATTR_IFINDEX={0x8, 0xb, r4}]}, 0x30}, 0x1, 0x0, 0x0, 0x8}, 0x0)
sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r3, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8, 0x2, 0xfc96983cc84dbe8a}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast2}]}, 0x30}}, 0x1040)
r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:35 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080))
syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00')

03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 1:
r0 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x42)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00')
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc))
r4 = syz_open_pts(r3, 0x4000000000000002)
dup3(r4, r2, 0x0)
write$P9_RATTACH(r2, &(0x7f00000001c0)={0x14}, 0xffffffde)
fcntl$setstatus(r2, 0x4, 0x40800)
pipe(0x0)
write(0xffffffffffffffff, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  394.714941] binder: 16295:16302 not enough space to store 0 fds in buffer
[  394.730214] binder: 16292:16301 not enough space to store 0 fds in buffer
03:16:35 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000100)=@generic={0x3, 0x0, 0x1})
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  394.730243] binder: 16292:16301 transaction failed 29201/-22, size 120-24 line 3475
[  394.730570] binder: undelivered TRANSACTION_ERROR: 29201
[  394.741671] binder: 16292:16309 got transaction to context manager from process owning it
03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  394.741682] binder: 16292:16309 transaction failed 29201/-22, size 120-24 line 3129
[  394.749479] binder: undelivered TRANSACTION_ERROR: 29201
[  394.844971] binder: 16318:16323 not enough space to store 0 fds in buffer
[  394.845014] binder: 16318:16323 transaction failed 29201/-22, size 120-24 line 3475
[  394.845219] binder: undelivered TRANSACTION_ERROR: 29201
[  394.946409] binder: 16295:16302 transaction failed 29201/-22, size 120-24 line 3475
[  394.958494] binder: undelivered TRANSACTION_ERROR: 29201
[  394.964101] binder: BINDER_SET_CONTEXT_MGR already set
03:16:35 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0))
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
lchown(&(0x7f0000000000)='./file0\x00', r2, r5)
chroot(&(0x7f0000000100)='./file0\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14a, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000002300000000000000000000000000780000000000000018000000000000001e3f673aada23de58aa8bb8c12287495229176ff998589388c06ab05028c5dbc239c89265b8aacde16a22a161a08ecc712c9d09fd9f651cff18f9ab770ceb41804bd873a27e8b72ac390cf824638bc23762adbe24f3a8bba31c8aa49085621b5d03d968f088e9ea25f116ee923829fee413245cdd1e120b950de7dab6c5a0860891d87d7362f80bd545b867850e854fd963d03028cbb25daefab7e82e22d33480d8064c23d5dc0245e2bc7236095a3f6a513a0a054b1495cdd7d27a2a791a3f5cd75f5e424081a8b263524e5498e6acc057b530c6894d6d7e402358304cc2b087435eb9217b67a31275299e8e27e903b0d47fce3844df4029cb4604cc3a8f3803a576edc55f2f21a9c169a023b73e16ee8608d61c8c0014cf5e7129202e477486b46f0c526e9dcfac2d5edf6ebac151ac99bf2f3c8e8b87f6a4cd004128c5fba6a7ae4298cc0", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001c00000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000000002800000000000000500000000800000012c8984f478e97e10a9ab17700000000"], @ANYBLOB="000000010000006ba26c22a4a9e55c48a0745719027a71340846d27331fdee32c44b66012f82a1d961f8a8191ff7519b4f7cccbf9034254e6ceea147ccd3100157e6ede08d721b110f2c99fdb8bb3d8645729c391123a816dfb9abfbf262f2bc7dd0432251f1b905ce377d41a3f06902f752f10e231cc1244a24d39cb6a25f35d1a71dec236b0ce06b9051051bcd6128b88a49ba153f2eb736cfcb5ac478e990f4efb3fbef0b0e1449480d2daff31d4f187c771a6b6795afb7630ba4013d810f43190c781f67cd21"], 0x0, 0x0, 0x0})
r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000780)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0xd3806314}, 0xc, &(0x7f0000000740)={&(0x7f00000003c0)={0x368, r6, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0xd4, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x52}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2f}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffff7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe0b}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}]}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x913}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x704}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1c}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x66}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK={0x94, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc5a9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x298b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}]}, @TIPC_NLA_BEARER={0x3c, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x26b, @local, 0xffff8451}}}}]}, @TIPC_NLA_BEARER={0x40, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}]}, @TIPC_NLA_LINK={0xfc, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1348}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4590}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffff800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x93b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}]}, @TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}]}, 0x368}, 0x1, 0x0, 0x0, 0x4090020}, 0x800)

03:16:35 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="66643d0d996d68d3bae492983d93c8d72f24065a4282aae9d9650457912df88df405a9bce73668e8662b49c568a3cd2a82e7d41e380e7f0d151853529b868bba8c763cbad1717204b3b029987c2e5d1c5fbfb445825c9a7eca17a3637fa5d6b66549c76be41b8855aaf411aa783ba4ded5b0b1604817b006", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80000, 0x0)
setsockopt$inet6_tcp_buf(r3, 0x6, 0xb, &(0x7f0000000480)="648de6e1661aa3aaec2663649b747ba175121955180c937215beb50c84348fee150beeb7bf6aead2395ac8f7cd13316f38ad11482d7b1a570a4174a34c58e762f2595335a7ef79ced42dec257caff5481883b4bfc85ee7b30c3adae410b5cc74396ad7d130a8039065f46de99b632f86f93e0bf717b8cdb407667326e618dd51332e14d2b8c7c3951376366299ddb7fc7a79e9c91e3ed513ca26cf3ae70e555adedc47a08c407709fc2e59f778af99a691d1a1577bb4069365603d734deea944f20a987354804dc41a1e30707bcfd55aa33f5920a4ba873dfb8c40d76ce234b8f79701f8c3ef6fedb54b2d2e25b9dd960fa89f9f56d7fc2f41f497db7b5f19094d7ab1834b552ed4291ed5b44704f0be93f4ada5dcd4dee070f3e984660dc10c4e169fa249824c6c65c85c881067f635f474c0785b8b6701b2692d0ca1e7fdd822bf82ffd0b817453d54303fbd0a7c2e8b3025101a0214f3f628531ede7692a1cc7c9c0826291b04617abbef920d3a416b15f779e07d81fcfe7df1f6dcbb4ae15b588ef7ced3af2a2fb0245ba512313b160f61a2094b1e0a722f4d73e2e154298884ec753f632da3f4b782997e4eb19283bd23b97ed1960917b94c5b94d3f2db5ba5dbfe463379132dd2c8102e3281428286d270a27986a8079cc9194ae0d42decd038e715aa64432531f4283d972bf9219b642c7babc38d26c4cb3a443e0c2f3296335a2bcd13b601b3669b8e2b88b1867bd8cde30b0a7422c00d5810e282bad637572d4ab38b432a375fcda0ee626c0160c117deed61211d1728a59fc06d239b77e04d18dd70198574e57a55e339c5dd69c5ebb2b1d8e35b372c26d55267e0bb71118c2abead0019598cef925a1707b3e6d2b415b99b31c31787402322fc504c59ccb7e4ca50bb56c775bf0a0e2b838e6da0bb72e82aba6ba45471b48c7524946a4408928219f3375f54c923d72a6cad3c44b5d3271639ddcf9b924f4bc2ebfc5b8e53618162fbfd84a2e8bec45aec19679cf3b714e7817aa0f9af290b84b47096598a37650e9a1e3eff62f702dd4ea6d5995626eabd2e6af46cdc3792f10ad6693cf16df3b4bfbc80bc44eadee49e01d4edaf0f326179163f27b48a38707bbc1eee2d4d30cf249352308928e63d25fa3058fce7d1f186d06a0ecbb0d4a75a03025885074ddb166d4b464d5f7c567ccb3b173724150db20d1c4f61da6fed86408eed1041e185010231eb742ac611fbd56917ee60089e1df402def2fc5467651e53891c36612601f91f9f97a71a57f1c40cd228424ccc022484d317a707e74d42116d7173892e670e9be3117b30bb0054ba7a5e0aa6760f1b8b7d3340b579f6e949456adeef2b78b499be2ea0898c2d00f4d56ed1e37e6179ef7b7fa309a5b545a85e6bc6673e17329ffc9fc15b479ac3d13962d6566f81c96cb2e2444c2c65d3934bd8ba538db2e5ec8eea2ae82475c7f923bac203fccb7808db5018dcb93f43dcd234e289468e4bdf5055e60b7af2018f8e91a6d4d8d7c15c6c7a6afd1429f532176da74b1516b7c4934c62dccec8f5682fd430cadb02da39858b8b6cac8912ff95430438cc0e6574b8dd8c62207302185cd01c4b56a7c10f8afb56ad81e7322d9662a2eb4cc95553d07ee15ec068c6e06b670a9882441921c53f58143df368a45aea06b36651760afe29fae0cdc4b707fc20224c6d899f3bc2b963e21176726546a41cb7a79069a87a0f8d57bd2dddbcfd5b247a20ee8f3bd9e2519cd9d887ccabb939219fd428eeae858dcf8c3423e664d054f121aabb8610b02c367fdb0407dacbe5ef49a7e01e35d6b96eb8d9a217481fffd18c6b81817fdd35ecd321d1564c853c25fff9501bf19a1472c9d3a7e0d08a48c90ac12e458e79616bbfea895a1ac6f7b56ef715c1bf647c474bbaff8f893e5764797f0b24a1cadf54e6a43131599dc7e58a9782967d7069700bad5d00aea57565b1e24e8c284315fddddd91f145a901eb70e9faf298b2e294d37b178a2a7d3493711d34641e805388b9c46a1f6572b5e5aef08f606f24bcaf91092f80db7fff1365736dc66bd898e8660d53a4183e01a84d6fba8ab0ec7f75dde6df8a54a7adbbd59b93489b7663f4bddc8066d834bc4b7c1a0e2fd381fda88e9de559f5ee060524c459fb06558d741dcf469057d85a825930469f978be1e737d3967f66e4725bff65335e52768c3365a222e882270f2b49410440af2066c219d315a6c51e68ba8678e9cb9a94a3ba280e7b054c97f186e03d602ae450d4a80683bcc2bdf01c67373863c8a303b0a8ac1f4e4a674491e5175f6c9a0ecbb304c9ae9d55ec1ca0c3b003a05ee7964d23af4e8a3034902ebcf3fdc29ee10e4e90efdf6c2082ec7ed9c23246676c02aff6bdc8ae2ff8d1c949aa29e2c7b0805d2151ae2c9af3963c90e8892914ebfb916938a309c4c3e0b8cc22cae726a4f83bb95b6825af75348a58500f7e4485079a015d0f1476ecf692fa852aee63c67cd5245c83bcebcde2cc3f8f953cd36f2c963b9cf7423f44fba16c569bce572400365b39d4d743b07a24c70bf86c0859fb6df25da939dd24829c19eb690dad6de0cd4a61425e1f44a7a13019d97cde2200bd409aa1a0c060fe3f078fae67975128642fee4bf4e0d6a08813319cc370db108753840a8b968ea2e0650e1857999e5d7269824f36966967151e5099e0ec7744b786259b04eada2841a0bd001e91f8fc0916f6572f5aba7c5a387e2242511743790e7b793a86e679a1ecd1d8f305cbe949fbb0bd57376d503643c9b54d839290d444c682e08637ba7bc6276a20a684556b9c1695a4b76a394569af70570f69b9f51996ed5a6b597620fa424a0117f7679b6d7c759a3ef420890418b98e0ce419058ee8c7a2225e82c87b301ef5acf82bdb2744cb771ebf440f07e0c4613930bde99c688d79f081b2227236c6821cf5d8714ad93d338d84d23e72b47fb1a924d1d48b26e2a8375300f21d4a2808506020a94bdd80fa96af660363cbe8a96deddf9c81fe35dc4cb83022e143773b5bfcbcf8be271b8af17b01fedfca4176a90f2a90d70ba438b9bd78925f5f54d9900dde06d15a3a41c90942e3c718a6ccb9269cb63125725c7bf2ac033b76de4d27a2eceb7f91373cf87602e0d92534a096087c92f61bff07bf7cff364da2354f5c4e45959ef263d8cda2d87e2bcac8c9073dd1781beba1c6d94898f53967710f391eb84ae5f9020ddc57d850e32d88b26e19a75e59352ba4930fbd6a332efa813f8d413b563d156296b89a13b0045933e1a7899414cb4d903afe771031d2c7ea05316c7644058e3dee240b0a7281b40b08248fdace5aeeb3208417ccc39ca3e37825f9f6310fe3ce761a204082b386fb787df65b464220c03e9151d259ff9a40ce6e233ad656d5788cc6ddf82edaaf80945769af556760f8ae74181aea49d8efe489dd74f11a6ac37c605fa9ab38dc33fc90ca1ea172fafba2c8484a7275803e1ee28acba57d1a52331b7abf34d73a4f2838293f708a1dcecb9a5668eff17ccd3ff37ae5144651957126911d86e68322c7a106ccba39f74eb2f6e4783c2ce95ac20446e86f721afc8156a2d1735baac3267c98c6c55e3489f456f9c421bc208d7e5763a30f168d6212e3460133e97b7d14d0628601d91e9b9a5133613a1b2500b8361325abaa7005fa7343e0bfa229d753bf27860c315ff9966545064cbd82cc0370bffc5643f52ca8410d1ce47d2bafc7922b87dff9b2052cf8e29b71a0a933f4a3581ea012b93e7f83a059b21e60d3718b57c0a363cfc5f93fe94f2ef45ccc756dc8b489939bee7d80b28acf69fb8113b65e689bd3c2a1177d537df3d3412c931c3a16fc216d91ab08cbac165b1fee2cfe7f0ccada59660b643e5c03ac13954be530e7678b150e4acc993632316725dc698452f1b87e0b53eab8f07cdbc0132fa5a7d726f57bc157f4d9ac91e3f9a3805eba770de2cf96ee2d59dd4752a9d16512681858fc9b2c00f637d2e9555db796faea5abe0e1e4ddf111993a46938d8cc5965007865b1eb3e72d05f2b03e42d3d8aaf2f104d70494d92697d4831b163f60b090c7f0f3f3c516eb52933d56ff0e6aace183281e8883c66ab414adffe6b3d09cd81c5f45c48bdc70b929fcad48ada7d386deaeda2f43df693d22b7a086605dd019cc631a0beea04495bd1e30064f00547970f7747bc73954d7627724c73a70dac90787fa139bc37bed5317acfb9aa8a7881581ce1ac22fcdb25abb09bee5c50395563a052e62de85c6c36b32ca8ecb595854fc884c38362e683800b214cafb9de756c5c7cfa6cb3936429590ebca3fac4494a21f11d89a03f4c21112218850b2960f5283402b268ed8eb581a2d2098e52d8a375cb66c7575e27c466239cab11e0ffa010a48f73702ea07a278c0079d2251f3a70b463e122ea0c8b155da63183721fa12b49f19ff064ddd8f2f4d8df8ed2ce6bb39933934b33d7e55462ed48494edd2fc0e4fa6c8267df2ac65c123b9f8fcf5be390f699f12846aec4ca8cc1eea3e4175af39d6881d7527455525c252c630ecd262b3723300a961854af03d5b0029eda04a3effd80b232f353221406d2958b8a2a84cd319ed22f76daadc35d02a81893125b612fc3558d430c840d79b410ddb832654b2516388b61927fa216b5691e19ebb7024335edb6ed7b8c35020d227a492ffe9477bf3087386a86a2d9de10c16bb7b29c26554d55a741ff4e160418f43b4e8e4066f0c5f13ac816eeb73975ba64b8841532608e91582b8cff062f63d2b81e1bf87a2c61ab7c3a3abba521a94c15b6320b58bbce7cf084b8de05ecfb800171c1381ff9ceab3082c359ea47a72bcb06df992aca1e1d2d420bf8e833a30ceb4d0dc30b85150b49639e286ca19f08350dcfce686a50544a92f10716711db43287a44030d2fe1f8326b849682f39e31d0d637da5d9593e6b884495aea3c93520c28ddf55a9c2fc11f1be5f1ed4545a80e67342953d3172f94a658841956f930635079957c29681084b7289ea7b50d70e58f150506f72096e61f770a75d4c789561a72a9891ac14283aef3342af9e9bf9eb68bacb359562010724302c515f69de4d63d498017af806432f5c9e50597b948e35bc29c35dfba4677003a34cbfc582e97b077819e40e9c7a773bb9e5a5d02f341888ab0e908a048bf6deb56a6af46d06d4bbac9708f08d129d3de92f4cf1a8367474a10c88832cd254cde73d204aa0966ca6f089f1e28350dfb609c932431d8fdd81343a269033d56318fa92c1da79e970b1f15376dc6aa739238b8990bfe07c79443194afd71278fe98d83afda496b640f6c8d9b03f92ce768ddffc80f8f505bdf962bd89ecc36e04fafeaea3af3e10dc0d34be84df37c3d62776e57a86edf9d36f1a2f150bd65aa898b64e891efd3a8f14805b068b5d1e65cc21a9fc277d3950a5ab4ac39f674a4ef506d73a28c67eb99a589e640b3cafcb8132d569f27c39ae9398ee8ebd058a50a911af2d12aefada5ad3614ebe8d240986b90d6bd9b039ebbf3d65cfd28a28af7a49dc5fee002dc89047dc95c9f58a2dcfbcc62bd6ab1fa3fa10f9edb0328d60b341022388403776db6466fec34c43c00c065df8850224ac9e077f1a4a0d1050e5e56d9cea62388757ad95e5a2ca6d910939a4ded691abf5c96cc0cf666122863f0f87099231a2b4983dff40e059d5d1e9e07f65c9aa76506ac0e7f7de819ec65fc083096c4503c8c87f78c9d3506296719b9eb6d8bc0dde45778413ce7229cbed989499ac0e923a", 0x1000)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
inotify_init()
r1 = perf_event_open$cgroup(&(0x7f00000001c0)={0x3, 0x70, 0x9, 0x9, 0x1, 0x7f, 0x0, 0xb1cd, 0x28000, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000100), 0x3}, 0x408, 0xb6, 0x401, 0x2, 0x3ff, 0x3, 0x7f}, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0x6)
ioctl$int_in(r1, 0x5452, &(0x7f0000000140)=0x8)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000940)='/selinux/policy\x00', 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@empty}}, &(0x7f0000000280)=0xe8)
ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000ac0)=<r5=>0x0)
setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000b00)={{{@in=@broadcast, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1, 0x9, 0x4e23, 0x20, 0xa, 0x16423fbfd47cfda5, 0x80, 0x2b, r4, r5}, {0x101, 0x2, 0x8, 0x7, 0x6, 0xff, 0x5, 0x1}, {0x533, 0x4, 0x7bd2, 0x80}, 0x8, 0x6e6bb7, 0x2, 0x0, 0x3, 0x3}, {{@in6=@rand_addr="2e0136af57ef8607722b457fa4c7c83f", 0x4d3, 0x3c}, 0xa, @in6=@rand_addr="5d09c219e4bc7eedfb44deec9ccbe591", 0x3506, 0x0, 0x1, 0xff, 0x0, 0x89, 0x1}}, 0xe8)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000003d0f86d5cfd9f8e60000000000000000000000000000007800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000240)={0x8, 0x7, 0x5, 0x5})

03:16:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x801)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
close(r2)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:35 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xa}}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
clone(0x200000, &(0x7f0000000040)="5b9f1a8829d2fcca569488cf3291fcc6735b1d764e18112e014d1d929eac", &(0x7f0000000080), &(0x7f0000000100), &(0x7f00000002c0)="93104a58eb7185db689856a59301db4138eae72adccbda2ee4bcd2b99f665cc7963764b2530d30ac885d94dc53cbef52abe5b83b4e5ec159bff6efed05b7e4e3db5d4c209c40229b314489793718aef0f0b82412a8e9701218141f98de0c8f2b44bc86af54a69e36102403340c267b36c86944f476ff8b252f185fb407ad0657d4bff31e56908be1196cd1c1be584c951be68882b3bcefbf0308df2be08cbdf0aed839efcb34d29dcf9c4e7269f5ba348a8120ee56e213937cb15e808a5e5e1609f8d3cbbcc47ef86fd4caebf431845fa2143a6aafc15bace8b5870da10cb95150469abae703ec2fa3905c4ef07d09083a62b6719ea8a456f50a1dc415d6874e8d4ba09c3b318352c89f64fb097cdd3c767a1a366e51ee378e0a04849f1bd0f678688f5a652b435f08b554f3625eaff35b899d39b1f590915f505a8065c8251abb1db007d13d3b92003fde8f563fb31ae75a3ac12c350dc51e931d750bdd6ae5a5c07ab69c582e83d123b7319ed4f6b3be2e3c6649bd8f8495d756f269a8591d65d2eca119fae88b50ad1be43dee64e843d011b9656072eba7ce75daba62080c2a9bba6db0e065e70a6890c016468def353577de99f8978a07bea884c4ef21bf4a4d91efb7c066a0d6e29fc45a70c37d188624c7da75bb369951246fc0a5ef1778278e53220965449ff1360ccd5627931ceeb3c36336b23f4b6accf298a261dce096dcf06660d46ed72beca526f25f999cae8aad6e0f0011c3e96509b64ceccab991aeb2bbabd48a15c35f5603172b67e23b3499e4e5ea6ec565ab734f0278371c2e866790457d60c3f04c20f4c1e69c69d42ede081e5ace31adcc672019a9472a32b22633b110755d7438b076e71fa3cf8cea578276871340a3dd5698fa9b8dea23e190737a6a18e12ab3aabd59fa05031d0e3bffdb54a8823f9a209c22d240458ff0adf987fba32f3048acf26852f8c54ead635621f27dfb2a006ecda671d2abbce4cb85372fa7ae0af3b5ab4025e9298e4207ef42e596b83696a77160c7983c0ca57a576656d4a26b13e2c80c3b0bfe01aa411011c8684c7e1d16988a47d66c56de7ff835d482dc9adc36e753d6eb5e018433d279f3512036ab76038508699270794771ed0870e68dd4593a3bab8fdef3fb5d741658bc409cd00062bd687bad7cf61c9dd0148eff21b39cf0580bb29ad3a0240f349b726be1b562f77b0f73e709706a108c71236d96a8d5e4fd5520c14468207821e99e8061f9d8cc46dd980b5fe74f82c5d68fc8949740b447edf716875d9285040bc9683baa1873e273b622b324df783a6d54e761cff15f4f3cb99a80501ce2074c19374da6538a5d4ef8b940054abc85a5c3a1b25c9f42c4593001e7232e8914bbc57e05fd5d5d045e8abc152f5c02d8ce3543d31bd495d6480b694dc50adaca51fea31745cd45d11965a6b96e5b2275f9d3d1dd3f335d26797d0ce334777890bfdb40851ea12509122139eff13cf43919ca34bffb05e6c70221efb63754bd2c23a1c20afd94ff2a5224b76d471d67d95bf7ae76a99d578a51856a6140595350105ff8cc134c3e5235eb4977c30685e4a3739d5786dc555615ab2272b6de7a109e340cd29f5f22d1c80eb170f724cc4cacff62e0b7fcf0f7aec0d43ff9cb356d339bf57408e6422c7f0a269deeedd70264cebab55c9eda5a7edc8a50922dfed2099e01b4c9ef0a099667ec4da683cef27da98e70fd1c3aaa001e85a49787c14398e5677e08f599de514354e27797a9f32c9cef31b0bab6580961a8cb512f3756805075def4b7f667178e9a5afbbf91d66d802febc4383698cadfb3541cc57c14f3f4fed24b0cd9cff8253af1afb9afa7376ee6343acae24bf33baf7cf7e07fdad0d200ca676d66ae5f3f2d94318fba1301c60dd6ecc6a13a36512561ae572f3042a776cb8d41289f61bddb48e0398e27d3ecf9d502fba0143d93eccdaa96807836c3a949cd8a625ec0a71c9cba27cc828184c2e02cda9ace60a702accd6b3b2409ec9c32e01aba59735b3cca5c979c49fb33bda910f83f4ddf19ddc7c1fe217375d0b07018531aeace66e6fbbba3ba6ff57634aa89aded602958ac546d1ea5b891fe0b8748ca6318420b7e6cf41a4c97d3617afebebd3c87d668cbb275fd9bb4bc95d89a4a239c2a0e2b15cdabc969a5ab68b244d054073321b10eeb77ddc7ddefa5cdd53f4f958590831fb99fd84a21d895a75b718ed132fff90d5d2038ce6b6cb673e39197cf40d5b051dfd8f9b84d1014a61c9ffc43afb9c88df39e0c590c12a4de52a33297ba9fdd0a94bcd0cc28041384b5ffea67a21c6da110c058c94e03137218772805b2357783dd099ed099436a83a54eb451647faf5d53f07754ef24448ec0752b05edf3181449ca3445961bb76245d038a40bdeddbd7d23afe8aca8f4ffd1f64f4a75382890a1cd46e3c5e61327364c6daa2f96f0d89dda35b458a40249d409ac7eb56edbc8a378396b51b8f4dec38439c111d8164b783729888033c9d682e501e9bb91fd05ba9f4cff0083774b3438257e1b07997ca8fba99c7244ad1c7b33da5d9d9b0dffb56f45d044877e15cbf279fa95a41527b740611ce3074013b0500a6d227654db85f4c92bfb085be7239d47efd8a27d7ca20e104f399e85f29ad396645b3d542288b330e2c78d4190a28adaca61995331275939e5c01d02e5d0c2d8b960c7565e50ca700001bce948ace35a74f9ede5f37bbe8879a06c4335ea12b563b1a4ad448fe3ab8a55b6311a7b8716663b3e1979c3a0fa65883d9283ef87f9d705c8ba269eb7b2d7bb99a2ca02cc9664880925f63b384ebf1988905cf5c1afcc6ad6b28c92c5a6b735dc67e375afa37adf5c7188960fb35d743e5527bedd3e92346d14e1a70fd47283b3f072e77b244ec9d56fc4c6b8c1c074d133e76388530f4c81ed94374bb51992e97957a628213a87f647626cd415fe624293055d9555913ca122821bd28cf8f045813ed26d8d92448b41065082907de891e0f532473a72fd04b84b276b78b5faa250c9c3eedac9860d4c4099657a0ed26c5a17cff220605ae5b90cd100a45abe55c45e575f940bb959d5b37e8899db6cb730cdd943b29b49a93fc4cc7477d689b41260d4e755641c7931a0e39b3db79dfa9484bead1fd1051849ad36936d23699cc24882daef9bf3726acbe7f68001dacf0bbb412bd2489a008c0300da08e702840c35abaa12134c1934067d0a1996dc796b2858a1b5906df771bb53ca554a792ca19af7f7824a71112a920457f7801b77b3c16836c69987f26611920d9c87a787f86a34d13282a53c5a8b6f6d000dbd94324d6052a7d7a962beebdba63f67b75620578a9757666953ec9ab9445a0d2cb91b0424d45749244190fca69d8191015fdc152e57c5557997816046d107ebfaa7becbfd9d4c7864940c01afdf36be955081260948ecb504700c714c321c8861fe6974af61cdb7820d345aa847b394e3c89f536b21328b3dc725e1d2dcc4b0740ea7ac336b4bb1a2719cba53137d0444de8a370f9877806b594a70076f792e406c82930a5b934f634ad1ba9657f682bdc417b79e9b9fcb367ff307c18853a85446b9f648600dc3b8f95ec3e928956f4c0e94e7af6f07f0cf8671345c4d30dd870baf9022f1ce87132c38c849b72fb21abe41b68efe9a4fa2ace8a249e0ccb50f37e4ee2ce39d9c5957c9ec50152535ea2577a8fd04cd86341beb55fa8f04b4a50c7ddf34c9298cd37e3494aa8eb6dec11c2b027f4822201e930657b4675df66235463f9d816711d6672cb9acfbea99d473ff64f41fd8d36eacf678d6c5de98012956dfbc5eda295626f22743d92b0dcde33d3ce13cf41142c41385dd39c59c26c4bed19ba6933090f5134d4d4b92be52c5d76a9b0e34d2beeeb1361fcd214f719ff559292ff8d26624651b70abca378405cad9f29f674ca839fe4f422f326339ed92f0fb5136e9747544c07c385fdc5c66a68edd9ec52a3de99a415f26e03269e0925295ce410d091834a7c8ca7099794a53326a118cc2fa7df81fbfcab80982267983e16047344f2fafe87c51c8cf391c6d8f993ef7e9b68d5d46f669ab01af554dcf4ab2953b7ea5d63e2050d97de046a775d7b7139b9efe1139eba20fd25574de943946e2a91385a5986551ee057e5b9f7a11d0040c4e30f29b26ac09a82e07c15fb79bf682362d97d21f162c96ee2280e07614c5447c43c1ac6c9ee757c6e9e7611038851853d2c0b9235fcbc7fb02daed2961fb0dc71156591e55368c661190d508e7869966caf06116568cb79ff3c6fea215e4fd437295b24e8d332b36ed79793bc056e95add94a797f6c4162bd841fd122ddc74b19a57179c40e9d3eb0412d9f9294f679bdaa4ed54dc2b2511f318a1ea0c4fac6654893b1741f8b105fbdd5e8dfe61f00dcc378e76b64c76ce99de181f812c7eb343377171d0fa1c15f312b6f0a602afe31451476f8bd9f80f433dfd3f51a364c2efd9338b502d618990d7c966a63f26c7d6c75bf11b552990972a6d93d3958556fb27ee793107fe3c624acb5dae6c5d64181d42b14be2f3cda5afbe6484222b9e2182926123cad1a26b02b5aaa0a099c3b1d76b3a237ca874f2ec66a93359a4ac592a752181552dfc4242776e9073d275f3cb035408ee0a00657685f4e1bbf5465d42c726f5ee8ee0f6d3835d7c3f3b23369ad98c799a010f732a5bb62fd198ae6d6371e05d92ebdbeaaadca3a65d6d6ac4e8a4622fff3c98c26eaee82efb0d564c11c4bb762c9cc4074d41d1e3dfb5d0cc70f9e7e1797cb6d0d4d0fdf54b0a290b1c7abea9198664608ad96a566aa0f4f703b3a9d0ac5682bb81f054b5d040997d56b06d50be42d9a295d2cb805fad7df697a1fdfce9a7acddc342daf3693aa4bff58626aa24d750091a0cceda07e5b406e4a4404201401baaf1e30a549823ebc25e14ac5d4d92491a75fa71f9bfa0d0755fa2e23ba1ab1849e1d96cbd3c3e97d5ebc30e49f5d11c538625ad8cdd6c2951f28fc61086d3899bbc5347739dc103678ef2af5db01d12c1c52d21ea64f223dd2f61dd528bdcb061d64a9722c1bc7ee5e2067773d160ebf6d53a943b47256b6e2786d0ab248eedb5d7d33e9fb3257fc11d06f998bb654d299877966fc761d747ad271a482dcc908b05ef57b5e02328667fbe871a0daf6a304a0f9053dea5e7bdb2b37083c0455ea55e9c0746ca1c3b4b0fa0f492a4985b95957a1aa31d6c1b3d6aab8d9875cf36f14480de1b2dc6010631aee3f6aeefa3893c51403ce37606db4e6c3c7220f3702e22398dfa59bb28ec7755743a5e16342e60e18a0d047b383d09cea086555cd58617b44b155e8190aaa8ebf2109c2b3cef12477face404145e30dcde6373856947c019f842113368513f6cc1cd0fc335d3671a01b4d001da21aa403e91507ec2c28029b143160214a5709085a7242d48b21681eb38bb856e55511d2af31b4552d75d7e6eede0f47e95e3480726d921d02f2d4664b17128184ac4720fe8a3bccbc3af8c5851640ebe1a0ed41d08d60ec2630e636c96f10459c33f0b38211c1c23948b003f62ec8c124b2f9311036e9b2f0882024265b435e124f071d0f3cf3d5bca447da815b074b82c012621b9353ad683321564bed1fe927200188f5d7265bf775a3a468b460d8222560c1556f88454fa088c8ff89b4db32c9f20262191e1d2b51eb4975b4e9df88fee771e5ec82eff6b58e335abc2db77274ca5e8dcb74808ff31ed3ae8e688c40ae45687033ac38f83538ff40027c63a4cf5")
ptrace$setopts(0x4206, r4, 0x0, 0x0)
wait4(0x0, 0x0, 0x0, 0x0)

[  394.964109] binder: 16295:16314 ioctl 40046207 0 returned -16
[  394.972685] binder: BINDER_SET_CONTEXT_MGR already set
[  394.972694] binder: 16315:16335 ioctl 40046207 0 returned -16
03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  395.060022] binder_alloc: 16350: binder_alloc_buf, no vma
[  395.070557] binder_alloc: 16342: binder_alloc_buf size 4073934234395775416 failed, no address space
03:16:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:35 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
exit_group(0x9)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  395.070565] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  395.070580] binder: 16342:16354 transaction failed 29201/-28, size 120-24 line 3284
[  395.091856] binder: undelivered TRANSACTION_ERROR: 29201
[  395.093544] binder: 16345:16348 got transaction with invalid offset (0, min 0 max 0) or object.
03:16:35 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:35 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r6, <r7=>0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000080)='/dev/fuse\x00', 0xffffffffffffffff}, 0x30)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
sendfile(r7, r8, &(0x7f0000000280), 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r9)
r10 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r10, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x3ff}, 0xfffffffffffffd0d)
r11 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r10, r11)
r12 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r12, 0x0, 0x0)
r13 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r14=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r12, 0x400454ce, r14)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYRES32=r10, @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030303030303021303430f30ac95ed17e2cf05f69643df9a8898e513622d28006d2a9bf5c1cc49048ada9a91f55874c81f494a34cb64fb89fae86cd6087aa48bb162aaaed736f3347837ffc37b6e62ff1b73d6f65de5cf5603be1426fd2f426732a57e3cf5adfa2400cb4e2486cf7fa14d0cee2fc8f5f3d2a01cf77b07b970b4bb35228db0493ae581783294674902ac82a8c3ff08ae152dcc56e4e5fa0f24124356e646e0f6bd6c42ff5a0116b4303cff79595c8f4f2b6debc119bc50a271efd0c940ea5e02f28c8081c0369a211cdbf96734ce51931afe0598b9da400"/252, @ANYRESDEC=0x0, @ANYRES64=r3, @ANYRESHEX=r14])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
socket$inet6(0xa, 0x1, 0x6)

03:16:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = creat(&(0x7f0000000100)='./file0\x00', 0x21)
ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x80000001)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x800)
ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0xffffffffffffffff, 0x1, &(0x7f00000001c0)=""/151)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000001800000000000080000000000000160000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000000f00000000"], 0x0, 0x0, 0x0})

[  395.093573] binder: 16345:16348 transaction failed 29201/-22, size 0-120 line 3379
[  395.094195] binder: 16345:16348 ioctl 801c581f 20000240 returned -22
[  395.094733] binder: undelivered TRANSACTION_ERROR: 29201
03:16:35 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:35 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
r5 = dup(r3)
accept4$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x41400)
r6 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r7 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r7, 0x0, 0x0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x9, 0x4)
tkill(r7, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:35 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000001c0))
fcntl$setpipe(r0, 0x407, 0x401)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/hci\x00')
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@dev, @in6=@initdev}}, {{@in=@remote}, 0x0, @in6=@initdev}}, &(0x7f0000000140)=0xe8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  395.107542] binder: 16345:16366 ioctl 801c581f 20000240 returned -22
[  395.279770] binder_alloc: 16385: binder_alloc_buf size 1125899908284448 failed, no address space
[  395.279777] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  395.279797] binder: 16385:16391 transaction failed 29201/-28, size 914793675751424-211106232533024 line 3284
[  395.279953] binder: undelivered TRANSACTION_ERROR: 29201
[  395.319436] binder: 16395:16397 ioctl 81009431 200001c0 returned -22
[  395.322548] binder: 16395:16397 not enough space to store 0 fds in buffer
[  395.322574] binder: 16395:16397 transaction failed 29201/-22, size 120-24 line 3475
[  395.322732] binder: undelivered TRANSACTION_ERROR: 29201
[  395.328547] binder: 16395:16399 ioctl 81009431 200001c0 returned -22
[  395.334438] binder: 16395:16399 not enough space to store 0 fds in buffer
[  395.334461] binder: 16395:16399 transaction failed 29201/-22, size 120-24 line 3475
03:16:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='\xf8\xff\xffe\xde\x8d\x8c\xce y\xb8\x81\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
getsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000100), &(0x7f0000000140)=0x4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:36 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x100)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
write$UHID_INPUT(r1, &(0x7f0000000340)={0x8, "78b5da6dff88c8b5dca5211d43dc9e74183e6bec3bea2f874926e6586e8c6b0d5a92a8ade609274c8b8cd461dba567daff710a224bd0f12538b953742e61e92c9d94fa93597dfae81e4e7bff0961fc4e05a2a4d345144c791002f48b27ec13a83b1b6337afcda28525868646a627ea618bb089192b3015baa89c99b4c0d29a650c58eb62bfa413fbadc981a6009c02fd3b266ff0ca519217f5a3ae342587679d7607d6213058466a189bd1f5b1b0d64e5dc25ef5179600f9bfa33173125338bfbe7353b2e1f88eed2efe5fc7b4b95cf8d9e0f79be3b94b3de0827cc389998109a3096bf113b2ff2d0bcad27a1d8c7322c54799ec8375405eab9bfc723bd9e53c3e7ef0ff50dab4100efd5e718bdf630d4597409232cd9358e8078a3d3d79ea0b07262c377c3f69383e4ac3e82ded9d28f1cd8ba452bd9155c94700e3dca09db727dac691976b143b13d62f9f1ecea3933ae77f33702922c5b6defb1ae5626cdb17f68e9c296419a8f7ccbf00bc53b83617cd569008cab8cc0b91630971b2b4d0acd4d1f739b860ef05521864f56095800cfa3d5a5fd5a14d703d6c40100d2974ae76ab26d70cfa4d867cf3710a8a1a727e3317abefe775cb6d8deb6ad71470afa7de240e293af88c94b8abf8b79ddea1dd16944cf4902b8ccc62c9dae82c8bcdae70349928e2e5b26658371ebfb22434275200171f9ef03e7eb8b15dca0ec4159bafe11e5b04dfd31cb903ade1e0496b327fcd10602a84a9c464d7fcf2f6335dd130b0acc2780c59b65a6373b61fab1f6106d15529b6f315d245bb352fdc9c01e642229c04f4b42e1ba6eaeddd831c21d8d3c439650ec52a773b38a4026b141c4914557ebb39defe6bd8fc3ef783d6841a83e3c98758eb62cede252d8c286113c9bf7a3c9a2f164459e0f33eaed88cb341b6f71dc82add98a859c747c5df8d3314068e97d85abebf9cec3d75a10c5b2e16524af03a23860a4f7b071a5d1e32568de16bc678916c9b52f3d49192c175fc6030f8503f3ff5a0282d6d6bcb5103ebfac97854f1088bd9554e08c976eb2ac6f41d60feeabbfadb55148d5da5274f9a3cfd743070660908da50ad620ea15d22d8faa5f8b45bfd9e764d2d1500199f08de8632ae08ee18b3a7232b8cb64fef0d3ec8cc94660eb6eddb321eed0d38294f28ccf8e40828e4ffe0a4bfd8c2a3ff6249802ea51244525fc9171925c7c2c05aa0c9d21414191ed328d6adc48466785ab489a7874b4f92c706f51639b7e18fdeab46bb5f09f0912aac92c7521a2a5153e15464cdf92b85df8b5ac3cfde4b8fb38e08478e88dc66f16ed8f9e5166973c71b9339ffc0fa1f759e970722d80ee87225a5ef745453cc7ed70f7bc46e16544923e3727390315e782cb5fd4543469221d1312732089f2efaf2419262cb61d20fe53724d8299255fc16c18e18d69f5fd83d9f43380be5098157498697e7c099cece53a86317e6317796c5bb85767f500401fd09ce33ace791572246e4b3dfbb7d1e73d2263e347ae41571fd14b9421c9d7e7362f5764bc01d461351dd9f316c50a228e41783f86763b791028ae786b99a112a9f89aaf1176f18cdc4fa06112df3da6dd9323f98c3e238ffd39fbbb8c4498a65366a0058a848216a69cc596301f0e47d9ce416fd06636f68c7f72fb72c389504f168c1ad5aa0867647a052fa6d68875341ad9d4e06de2ca77cfb502a86bcdb7012f5389ef98b4d9ad5fea6af9203f5086f76cc40b69a5cfc3c08edcf291d099e200ca3a775b8581ff4ab1dd0fad4d8c84fef5de638d754b98857425894e71673cefc32e851f1e853372f2531ce762b88907e5c91ef59fc5f64e3b51a1727b0391921f58481836a6a574e47ec7bb134f94d480e294d10bfc58d1135b6cab54797c7c32fca0dd0321e3a7300e30811bbdf724db071261631d370f705efcca94d1659557e8c0141b365f3112b44a89195b62354e5a8908ebc45e2c514a6190c790c1be121574b6b06638c89eeaac5021257f99c78b746837b3f57760482b22abcdc61a40dfbfce7072e41899a2e1a75b8c4aa03ad140d24b89f9c0e6313550d315a6855c7bc212eb4d96b0062c9853a4683f75e44ca65ff8163d38de0358d3e4ab16879665e6b632c234f57333e220b726d6c1938298701121ceed2f7ad8489dc2057d8ccc3d7a7af4d9f9fc0b51fb07b50728ff7525def88f0760f3d0ea4f31c1afce5d22810c6687823d2f90a643b0b22adaa5354fcae3968af9b94d90e4de35c2c55e73d243f515127597308c6b0ed6b6ff15585c62492c036101360bc46b0ff177d32b9f37e5fb76b57b79ebe9afcf679713baf0397066fea6a907c48a98f9e855601cd39e8b0032a96a4cf2338804c335a169c3b61dc037845cb0b484375754c70e838d48c97cd1df7a871d25452a1f4e59c745eb3790ab9281053c92ba0584e54f5c58326f17d9aa21f9106307b0a8da7ee8b9e592e877926b926130f9f7cedf8b7ed138769ea302df0e12571bbe7957e766dc2daccf41b7e0f5f76b70f64d62dc792ca0d785abd41cd64150cdc1ecef426d2a1034e2b48f0c94771fb208d45ab2df0ddab8a5eee1cbfd0119afc8c90c92689c26cc3a48011a123286dd92b2e5151c90c55cd2d13cc6b8faee615324b893b201478f9daa969b208efdc24bc68a2d9a777af78caf05c42e2d6e7ce417d730f2212f0ddc39b2172cec56ed416186ff5bc336e015dbd31560c2d7ca3dce6947f4eddf9ad3e145f4d6f856acf480f6324246c6d7f17777929d41c0322e7c2fce20e4e066007c422e7741a206aacf672719eb512196c1be46db9e55ee2c3ac33fc8653406cd442ae48399e7f3d97ecaefe3af6a5bdba1168d17e282567991966affd708fc7c16135afa20be14e1d8ba37a7354ca090d7eb5ad29d52f7cb9678342d4b682ad1469205423724666457495b0470156ddb92caab94e81b77f18ec8a7693f05f0f5debcf514c0f5c4b6406f72891ecef9012fcb350c32e9bdb4544667ad8cb1f71bc000a79f0188a066d0a184c12c7c3c598796a1fd2b86b2c974b5ff43797ff9feeda2e6ae6d5f301cb26509c1fe97a680195942cd609d09082c06bc3f26b6cd6b0f8520b645910d8cf32ced1a48d2f4ad5978768131f72d63f3965e8eb48ff2eb6288bd9e51bcd033a64f5b6d58caebdcc5f7bc1a50f1717e41d31227535bc8103d7ab61b56374fc681aad00366e0444966ae77e6c721ecb71f1024a399bd3a83600dd7319c29d9ab309019e8389075ce5b80aa782f65e8242022817d827cdd4c2368e0877557587ca0d5d48c6faa8ff47b689b25b54ed50f3ec62204fa12fdd57e0e5d1cc5e21346c10a3788a1b5a49408adbb176becb43e1e37c64ea6bb8e4ab910b13c67b3dffb1730cf944e643792ffecd6f8ffcf5a9d46130eaee1615ef0e8843b190cdd8f872427950d2e2215e8e0a99ff7c81d27f92944cd95e8cad1fe91237b85443e3fbbfd31235d047389aea7d64e1b94b6f4224586deee51c8709f43f499057f0432e3ee1130c5f9bc0c91e126a6db0cde90e81ad7417c9c56a7159edd14a8614e32d2f5313ee56e4361a3f352eb88e320751e3fc99fbde2f1c4258f6b75603d64167dbd41626b7a71beb20af29b1901de5845db0eb10ed89ea0f20079f7ec2a3610b78b574c6cdea403aefa7a348eed6373834fd0ae39c07677c42f6ffc250da91843da2eb9c17f45eeaefbfb164f9f2c5ba4dd2bfa0e919e21bab753a7dbc580ce8cf845defb8b475c662613f34e8f6f7f76735b6e1b0c79357e34f52f1e2d5623a1d6a1278ec44f4cf1bb9429133484cf0e5fdb90d4131f17f495d5ce50ed8cc368589bdddc64e1cc01c9d62fae6ef1f2940264eeb00efb9f49af5f754f94452dc4d3ca580b5a9e220835e5e1b48c21ddb7a9dd64aa35f3bafa44d7d5143a3cfb534d1499401442e6b07ed19a75457a465ee9b170659c3bbe712914092119f0bd683b1ce3e890d7af1dae05ecb7676ac80a041bc016eb7d6d113ac880ecc5d201fe95266c09c9b47b66e9cc9458ed9ba4629aad8eafc8a6c44129b0859ab63d3a052e1fe4052a14bfde729746b346fa603763fed2538eb9d94eacc32cb27968d78c44f71432af175c7d4b51dbc741bdb4febf89c3617868938fdf06ab7895e7ec105c47e7cdc58c7da0e6c01ae45cf2656277f8b62191c224bb0018a0ef0557db901887543289b7b310a240ed2a3d91bad1a02eda7497e32c85127b0297624eed09d4c1f93d14369e8f368658650efed263e7d279397cb98f0a9c60feee920bb901df3eea82cc5bdc9b93d4cf9d21523614a81aaa820ae64177d3ea66eeb3853643900d1e74e915da6657772fadd80e22f2ff19fb45a11166e302370b6bbbaa5eb61b34e1c9d2f81f5e37d1939dcb66ca1cd5e6a2f86070da0a440e74f597207ea993d982fcf33a4ac794053978bb2b4b69decdddc706ee3a4f39f80784276d682d78c65a4cc53d6be44137dc3e90c1bea29af5f5fcd140096cf7434df60d627540560be6a2157c078e0a039588dc197b2be0fa81a8443d509d10e2f5288d65463f8121ca3567806110a62668301b60fca8cc1295f5d0bb727a744a2cb2bb0c2eb3278f2a65cbf459429915c99206d1b5506532ed05a659b4c384659475cb32a0a9151f613d88b9bb4a9eb5842373611a18ed7002fda1e44062715235bd29f4ca9ea075f70f73d6e80b4e0398c5d0a61938a87ecd1d60886f89b5ccb6c3e305d2f6cd571555d3c319acd8e3fb979d9951f8938fdf17bd8de254261ce5dddab6ca17317f26b74b472148ebee73ca7fed7f586b143f2f28a1ab63ebad36436968937676c2a67e9eb60bd85526af6eeeff777c3948ed45ca324e96acd224a200a2b053d8f70fcfa14cb6f3398b9c2b91a1c50fedd4abbf48d9bd314e9f9e4bb6162e994bd50fabbcf40bc33457964c12fd9caa3e537548ef40df0de3d2e8d1a8e2fd419fe045350d3d38cddc40117e706ffaee3ceae092de5f742859349e6f79e2e211a84d00a292140aab93af49e178309518a1cb30f2ffbd74cb534fa4898b4ef122a041b29ca564f4e2b36e8c735ee4d67acd8aea9ef2a06c0a76509afb14cdbffe0aa1bbe1540f17a6000e31c5c2b579cad93690920f62dda60dc7d28d93569b31277e02ab639a298638e5aa173000cb6221dbf131ad8cbf053342cd374fa6211f6579892835031802db1b4b1e518c6b92907208578005a90e1f60826b193da592a11b12b03dd9808678406fe018dacf963a8bff60307b570af1ae81334c004b68e970c1aee983a1513678085977017ffd67299c1689f73345cb3bdbcda97b1b156088a04a865b251045c00179a36795883785dd168506aa30011a461ed0e5a040ea238cf61ee5ed7e3beecd6a78e51ed30c29f544dfe2b11b8e88c7c756be70264a7bf0987360de2ae1cb8fbffa87f7cd453637834827df792ce021377f7d97fdf9f7f0b6835be2f5104fe291dcda2e2520e7a7523b08d29c0b94840d08636e8eda3a74295bcaad7c5b81fb55eebd6f78a13a6bb48fb3fc9ad86e92d41c0aaf7bd828eb750885880d08dc18addd68eed99e2286f9a0a48ccdcf91df3e14348328f9a5c7ec2aa9a271f20af81ff46b3649128032c03e203da6936e1e3a96d2e1f10561333ab751c432e97568f110cb68a67d289ffa5094f78d0e6ccb71b21a87f6b01d982acc85df986c6aaacabd10e7546e5dde6a8cd4e1c1f27a62121c63bb6e7f47557e634bf9d3cbad45e7c0a5f59e2595d2c5dfdc172c0dda3a8380a78", 0x1000}, 0x1006)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
listen(r2, 0x200)
getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000100), &(0x7f0000000140)=0x40)

03:16:36 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
r4 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071")
getsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000240), &(0x7f00000013c0)=0x4)
pipe(&(0x7f00000000c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8)
r7 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r7, 0x4024700a, 0x0)
r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r9 = getpid()
fcntl$lock(r8, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r9})
listen(r8, 0x200)
preadv(r8, &(0x7f00000017c0), 0x0, 0x504)
ioctl$KDDELIO(r7, 0x4b35, 0x9d1)
prctl$PR_SVE_SET_VL(0x32, 0x1d71c)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001400)=0x1, 0x4)
close(r5)
ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000080)=0x8)
pipe(&(0x7f00000006c0))
r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r11 = getpid()
fcntl$lock(r10, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r11})
listen(r10, 0x200)
close(r10)
tee(r5, r6, 0x401, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @empty}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0), 0x0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r12 = gettid()
ptrace$setopts(0x4206, r12, 0x0, 0x0)
tkill(r12, 0x1e)
syz_read_part_table(0x200001, 0x4, &(0x7f00000001c0)=[{&(0x7f00000002c0)="2b229cf2f7824aa5dba2fb7c527d2bec45b20efc85987296ec961e2a4e36be10a9be45df98ccc36e3f96d87cfde5285d02393544ef5e0e9783d005d98335eb9e8303bec1919f99b559b4806f423366c370394d3a8d6e9f0b7f182c151756135883f348b1926a39f5d8f5b8ad93dfbf64e9da93b873627a644ba618d5bea946642406ed2d341b52cb648780917e2f3ae98848ea977b8b79378c1f94bd135dce7aedd3c7cba7932d3424482445fad3996bffc50f0adfe36c82d2427d51a57a63d3b931ae0a8a3151af7c35e71c23bff992afe42fcf54f6aa2eab842d0cfe", 0xdd, 0x3}, {&(0x7f0000000000)="6aa56ee17ec89450f91a5d2bb7ea3334ec25671a8c1541e95c40128b221a21ea11bbeb5f988e77684047cc685552d93ad2e828caf39f38ced8dc22ca4ae69d890c3678acbb30b193f888db48919a597e12edb5cbc12227eefff51623a4f2e59971", 0x61, 0x1f}, {&(0x7f00000003c0)="d08de916918a6bbb495213a7473778140c42e003c82e6c4ce62f0cd67c247726a90b601cd5bbd21ff90c0e8c653ee2cb2a89c63419fef3b1e5b307d62393771e8639d823103e2c7588c7be9e284e1ecf9b9240905fb82b5bc5368dc3a686cea7f9e862ad1d7b4ceb3b35de92659a5b05278dc67789b5c6d9250fa03b113736b4ef33345ea4194110f471186589dacb77955c707d169adab7f4abebcf49c694db9210a553c8b438f9913c5c0771ad7ca44bcafb312bd62828b3b17765dd84727590412ebab125610ccb40c3652726b005b3915946dbd52b24b7fd08f471b2d481ad170b27db1fc0ee0254512e19bf4709e2dea873740ad833f965debbaaa386a6bff41f948d6996608e87680d085a0804b8fcb08609880cb66025f40e249ab4a30152f4ee004ec7dfe3d3c52a01cb5a353752caa5fc6e87968e38a3e70963230b292dc2fb79095d014969830cafa7c862bd0a3c96e4a2dec62be27c3f0e6b8284930bcc8ecaec26ca67444eb9d9bddde1ff7ddcab5eafe586e1132b9740f9791b6a11685a30fc17403e71b6b811cfe07c19143a218bd83594db58f898f6070906611da55a14912653ee80cb808c5c23625680e36d1f7047652eb685804c6c81160f4a900a3c0bb994ab85f3f4b683fed6484a73ddc43c56b2bb4775ab814be5aa976376881530ccd65263813500705d0431a8a7bf8845c42fcf811de57f13d9a53499c9dca8602f404d867b20a507e49932e20e407f9f2581bf2716e07649a1d46c0d4e89c0db71348154c42dddfc76d66d4c3892780c843f8b9e0477befa54367ec8ed24240e5c3d624f5bcad508593a2ecd20a795ea2156134bb4afa1938199f0a621ce20505d28183f89c47786808ec7730f94bc37390df9741bcade50e486ed6099b26631cfde92efa091d522c4a4a43145825823aefdf44647d94c88ed67b6f1374a60b84ebe5c9af720e615d7a498a2ae041340edeb897c4371075a041d4bb82d00e86c5c839b0d48eb1ba872a8a4d6c119bf03e5dea34bc1042bec37ee0a7ca818f7064c4a23d3adff864dc37b0608e08c22efe7c1813e32cbfb944bf014d7fc7073c13f566c2b888f92fbb7247030cbf5b3d089e3f1c5eb58a4177c74db619cc065e0abf0c2838c3d07274f5566c5532a5febff2831894836dfb17d23ee787314b239fb8793dccc1d3606043615273c612efc4156a2410b066e5baf192e4e62ad112b4ab0de7c58bd09aa973a96a02c2a562d06be4d0c4ead5e2c2a81e1bb620fe383171ce0bf9f1c9639861bd9b8069520eec85d1735d6a9f4f92dedd2662cbe8cb624f8667752f78014ebaa71f2881cec3f7e79a0d8da058b689a6bb0643079f13a0a542fd8361c2fe43c039a28638cb0cef23d97c7a488e494c3dcba0c30f116d74424505904d2d40c695102449e34f12d9b27a31c6ba40690532499ab63f51e4843d6414cbebe281ff7a170f8441be0bb266e0cf2acd5fb1312c76e003b08006c653569e4b9a2dca3eec4be4e3f61fcbc936637382f0e89edd1e7b8dd4e695a2cc1528cb3be49a63db6afcc9538fb5a7668ca08b1c14c3110ac39cfde03e4c25e3c8fdc1d61b00d52f5e2fb3d8fe14c36ad09d7f45ccf06ab7f0348e42aec06c7628712123a2baad40297cd1a4eda1c68c2a2bbe4375d17ea6f04e4c6dc2aa47d2b2aad7300abb24e345cbbf20dc2a8ad0c38431a26f48a02aedb5092c0a86d496797b82a9c518c0bf761debff9edb12a4704c84aa3146c136a296434dacabd80ad852c37587aaba939670dff8e8914c4d4386a9733505bc1731f433a8fffec3febf7c29a3c51b9de34ecc648b076360b34cd5285bec5192c3c425a9df82d873c3ec27b55ddc77d6dbcb69d301afb0be64b08812ae9e58f1492f841676636684907b63ae537b55c4c68d7ef996a705942ed4390be7fbaddf22dcb86c806acbc9acdd4f690405447e8351c699ad3b6b54c412d54c87606c889c7d04498fdf4c2f826708d643264f65500e6c89c0f89d806f093115b4819dd27f8f010402e001317ef567f88026e631b20842b20280b27e5d3ce6bb87a6f07616762aa1da01fedf35eebb49cd7309e223d447b7cbd17d57308b4a406d8fa7db68dd81d41cedd71c84727c36867394df32f44e26ac9fbb885dec5bb03e14d74d8970bcd3abe1a3f39bc3aafbd8fb465466ce412cb577b3e6bb98cd09ca0c8b95449e551f7c1a1b0406063a588a2eda95530d66bbd29a9fb7a7ad6891fdec25c404a76c2ce2230d2500a9b6285fdbef1f865943de09b57630371aad2a5893e45af700283528f88b99c182f904e7da7d9d5939dc3cbe4e768e308dac6a3653c6859afa41da5a2d4231a82aa120e6b52aab64e851e83f9fab1555f5ea8bc73bb51c73db8c3160569b69a587c47cfa4ef5793d7c586493c88777be2f70840d4337e0f54ef632f05eb696374b0eccc6888c2fc4462a039ffec569bfc36e0116bdedc1e258529a569c3df37fb1ac7de3282cf804e5af26b1beb45346b020cfbc57e23bcf7130abe946e78e4af8b39bcaf939ba83552fedbfc66c84c710055d6b11ab71421bc77d373c4c5a50372b76dee2dd4b1b528a44be473ccf84529ae489d0f01147f940a4588e729a8ffa60de299896b96a85776515737f5a789753395d6587f6417a8cecddf88974ffb33450ff7421c7a9c374a33c9c594ee696bb44e1497d31518ed3bbcf86b24a7a58330a36ae3aa25104dd437a1aeba6e2303d5fcf3fa663caf90ec85b96143b90c9943e071cf08ba9f2c512e875eaba3dee93bc68982e1855e5e8d8df5f8224550d88848951b1bb32cbe8a36e6ba37ab91c97862d3311289cc88fa9d2ec1e57c0b8a9a12756234dc04ee21382f41cacfcb0c750ff80faac8715f9b216c2e02348bea8a0e69299a4341223332cabb534bb31b44b32bb6f5020be0709efbea592637259d2c074f3cf4599c3934eb4937cd5aa7798f686be46189d3697328553b132008911682ea02315861fed441406c086ebbaaee2f0e6203a27591346c9670b2e23932c2493c9eeb492a7326481df350dccbd0e6d8b196665fed2e0cd57a05f4510ff3573cbdec03ec83ab6565f3e69e7d2fa30e65c724f49cd21bf76874fec5098689d2bae5f2ccd0ed7187dd1d65b464df3fcc1fb77f79bd237fe0b641fbc4d36e37b86e62577423212971745ddb2b20167bee84fd75cb5849632c0a09d5ba56a4d7e4b57de7610eeb0bf498e01744dbb3460ecec7297194c80527a2e5dc224c13dc19fe50a3818df8a8d7a9e4aae52c932b5f41e739ee33a451391e341fc8fb9fe8ad3bedb33964ab196f8b5185565d1737090be46e627a8242a2f8ca8133e82186ab1237ec32bc7c3e845f6e8aa7162d035695a5a7f94462209342b9251c93a7775982cab69756a0518d9b35e3e2b23710e3dd0050c0a8c0fde7ea0ec3f7c39338be14ac624c8e04391380a1734a1d005891663ed16c97f7c9334c8f9ce6458b113d98d15dcc4b1224732e5d1b883a3c1b5f2b3a4a0a749fba5010746c60e8aaee370f3c311bb0075749a64a2f642f88bc4c4f41786f625edd21dd980581ae50bae6d12e2385182d8104dbc577f9bd2ba1cbde1cba97f1fb71c555dc9924de1f94b8ddd682c89ee6f68d864d89ba0c87da659bdfd501df1b859ed0cc2afabeb4dbc07a5d9b65adbdda38f455dfb1917402bbde4e7780c25f49483170ce90e0f72aac6b3fc072509bba72e4c2994d405e317ebbbc005d91589dabb362a31591a13b6c7f2fe9e81c7895eb4f9605d938d85aa31077cdc178c63e4c78f55c1b085064183319f5a95de2f5e83022dc1d9e3c23a02af80eec1ff7786269bcb59353ae16da7b686f29ce96cc0a74b9970ba1ef7a414bfad4ff42dd47910a9f0ffdc16cff659cc9269434e8c5036e04c5492cb890c7e9a6a29109df142cc3ab3e817323dff9093c4565f20ec34315c43682b1525f20aef523bf583424e979da8a817f46fe5cb1d0e88b8462834ee2bb91fd031eebb36f5d503fec1dc7adcf81125c28434048c8f354f823098cf9fcacf74a1039a260bef028f3af10e9e541ca1035566958b739c6af856ccd53e12949b5a9442706f97394b1553b55c35c58c1e5e6611c782fce5e3e8e553a2f47905e47cfa8bc007d54b91e1c8d6db1b31f6e5f017820859690c3b1326c9235ca9dfd4bb9333f596ffca17b6f2c9f84edb3b255c43f25e735d8162bcb695e7bd7d0f363cbc05705ab7f2362b48cee2a0ec49ad52bb21849fc0c02922aa0936be2c6ed82c234d14fdc66ed8ace5432cfb01231fb88dc6477a4734cf2309642f394ce36f65c82ccb44537dba9dd5cbb410fd2b2aa7b0dc38ff7f10cc16ed27da753479462c5be9aa62997fbdb5d2a3fb393c34f1b79a7f255fbefa178004743666df7fee541e5e590908a4162b757012b6a91012da69acb20738fe17641203115c5abb9c3cd61f73437d3f45da081dd93a9bec26d93c8d8dfe3cff55d4f3c31e349aae17bf16d3b82140fa3601ea9dad8ff13ba580584847c7adaf01ecbd968a5a609ff20f0767adc63e508447391b6da673a6b8d2cb15decc4afbc13cc0be71169b04dff952370a3a3f2d973bc23060a2f397409f46cfcc485db690b7e2c22d979a5ca730e030dbb5974d9c30af1dee0e3d723088a1299ea82f55b96e7b04a1b00d2ee4f99c50005a19d823812270ea45d5083ca4a0a98a630aea705777328c6b5c96abd4b6a8804dbf2c60c034b190eb2f257912431bd0042f3bd901045f04221978998473238b93ea1913382e05b6f2a1936805965c4df99cdcfa655c51b44412fc783dff8f9ebcf69b2a0cf76451b8e9f353b42145f54e507bc7fe203042c75644fc070b1b48c4f411f35496c03dfb2cabc3ea435ae844b07649c842736d4d4ab0b04693f27e43b6b02e4cedcc34de7701935765acf321629948db041e59703b0ef15d154b756605860124f22ce43692b963360b29ba072013067c9f7524d9a8d8144b1b16c79183ef98599ecded5f9e804cbeb2f88a44c1d250c309c27a97ee023dc3cca6b08e62371cac3863538ceb228b38fbead36deb7c84da170a3e67551b34f8ba20f442653105b91659d378a509f957064b38410dd84f1ac97b7fbd59f7419c6f5819966307d8ce54215a05453921275aca9dd2d8a94c2c9c4d3f03e61109202251a0a177476ad0311062a17f4d94291a288f0dcdb2a21724d1e98622301faf9ddbb88ebe1e319aa21b798f0c57fc8686307b07bf1b9207c8cd371d6b1b0fe238ac53e0f8c6a1cf38552a165d5d9b29e34609b731ce24405fff288f9a133e7966e8e06060a87350f8ed48e56c61e83deaa349b2656b6af4e800517ee4ba687a19c34afb016624f10a3cf526154e686c8352ee753095cc45f019285dff808f542660bec895461989de6778ee3ea6d508d99b630b7a3373dd5aa989fe81bb1bdd600625028b72a8570a87bd220e95aa8bc8766941f8f5f8e88b43f16dc54c3ad987d200df8eaa18fe28b779ad3f8a8ff2c5fe0038fc2c6643d2f5e157343a32cd775b24a7aafc3a7e9d8693040c22b5a9d9bcc4ab8be7aed202cd7bcf482b225ad1aa763e3a3e72e6d8c5cd08bbab5252cb6ddfe7ba871f35f9a63d92f7a5ec7fba11c45510d243c01d7fcfe8a0d310964e8695f0bdf33c0e10eca94d02c59b9aa981f2f0426bcb2ba4a1b81272fdc75fbf6c2740ec289693813bb4af2a5878f34923684dc468b001c515fb7e2ab8a4bbd4f207fb615b2e6764677a4fd6d594fc5ef1a695356ed2ba1224f", 0x1000, 0x80}, {&(0x7f0000000100)="151de212da827e7b3fd3ff3fa444f0178917b5865fa4ed02ca7e4e127071a0d45259", 0x22, 0x4}])
wait4(0x0, 0x0, 0x0, 0x0)

03:16:36 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x313f, 0x4, @perf_bp={0x0, 0x6}, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xc)
r1 = socket(0x2, 0x3, 0x100000001)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x20a)
r3 = open(&(0x7f0000000000)='./file0\x00', 0x42, 0x0)
ftruncate(r3, 0x8007ffc)
getresuid(&(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000280)=<r4=>0x0)
r5 = geteuid()
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r7}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r7)
chown(&(0x7f0000000000)='./file0\x00', r5, r7)
setreuid(r4, r5)
sendfile(r1, r3, 0x0, 0xffff)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000028000000000000005000000000000000c69a9b203cfc9cb696572ddda346283d5ab51f694acc6601cb18b8680e52a5055d5fc9717f1f508f510d9ffd87ce38ae0eb2063f94333de80e17152a44b45451134f4ebb65ee1535699489a5b219ed9bf16d0dca757801f77b1619ada65e34d866e36b"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  395.334611] binder: undelivered TRANSACTION_ERROR: 29201
[  395.496829] binder: 16350:16353 transaction failed 29189/-3, size 120-24 line 3284
[  395.511506] binder: undelivered TRANSACTION_ERROR: 29189
03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  395.577870] binder: 16406:16418 not enough space to store 0 fds in buffer
03:16:36 executing program 0:
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fcntl$setflags(r0, 0x2, 0x3)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
clock_gettime(0x0, &(0x7f00000003c0)={<r4=>0x0, <r5=>0x0})
futimesat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={{r4, r5/1000+30000}, {0x77359400}})
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x100, 0x1})
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r6)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xf)
r7 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000e300000000000000780000000000000018000000001e000025", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000100)=0x40)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = getpid()
fcntl$lock(r6, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r7})
listen(r6, 0x200)
r8 = dup3(r5, r6, 0x80000)
recvfrom$packet(r8, &(0x7f00000003c0)=""/227, 0xe3, 0xeed03288224a9f8a, &(0x7f00000001c0)={0x11, 0x15, 0x0, 0x1, 0x20, 0x6, @random="4a846cd398f9"}, 0x14)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000025c284cdcd"], 0x0, 0x0, 0x0})
write(r4, &(0x7f0000000140)="a52546b697eb1bfe200a1b341f8e8e090f91ffdf2b5d0035af9e31d4be39c925a902dbb547c14fcdcde511c41b7e", 0x2e)

03:16:36 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
socket$packet(0x11, 0xafa2ab1491f36bd4, 0x300)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
accept4$unix(r1, 0x0, &(0x7f0000000040), 0x80000)
ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000))
r4 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r5=>0xffffffffffffffff})
r6 = dup2(r5, r4)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r7 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4200, r7, 0x10, 0x0)
tkill(r7, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  395.600012] binder: 16411:16416 not enough space to store 0 fds in buffer
[  395.600041] binder: 16411:16416 transaction failed 29201/-22, size 112-24 line 3475
03:16:36 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000340)={'nat\x00', 0x0, 0x4, 0xbc, [], 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000140)=""/188}, &(0x7f0000000080)=0x78)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
accept4$unix(r2, &(0x7f00000003c0)=@abs, &(0x7f0000000440)=0x6e, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r3, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0xffffffbe}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  395.600619] binder: undelivered TRANSACTION_ERROR: 29201
[  395.666101] binder_alloc: 16426: binder_alloc_buf size 32985348833424 failed, no address space
[  395.666108] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  395.666125] binder: 16426:16433 transaction failed 29201/-28, size 120-32985348833304 line 3284
[  395.666407] binder: undelivered TRANSACTION_ERROR: 29201
[  395.678448] binder_alloc: 16426: binder_alloc_buf size 32985348833424 failed, no address space
[  395.678455] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  395.678472] binder: 16426:16435 transaction failed 29201/-28, size 120-32985348833304 line 3284
[  395.678775] binder: undelivered TRANSACTION_ERROR: 29201
[  395.758061] binder: 16446:16449 got transaction with too large buffer
[  395.758085] binder: 16446:16449 transaction failed 29201/-22, size 120-24 line 3493
[  395.758303] binder: undelivered TRANSACTION_ERROR: 29201
[  395.773651] binder: 16446:16451 got transaction with too large buffer
[  395.774220] binder: 16446:16451 transaction failed 29201/-22, size 120-24 line 3493
[  395.774353] binder: undelivered TRANSACTION_ERROR: 29201
[  395.795303] binder_alloc: 16439: binder_alloc_buf size -3617088956329361264 failed, no address space
[  395.795311] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@ipv4={[], [], @loopback}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f00000002c0)=0xe8)
clock_gettime(0x6, &(0x7f00000001c0))
write$P9_RSTATu(r1, &(0x7f00000004c0)={0x86, 0x7d, 0x1, {{0x0, 0x64, 0x0, 0xffffffff, {0x20, 0x1, 0x1}, 0x88010000, 0x2, 0x0, 0x1ff, 0xa, 'cgroup&+^+', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r2, r3, r5}}, 0x86)
r6 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000f70800000000000000a363981efcaf2640fbda002800"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
lgetxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.origin\x00', &(0x7f00000001c0)=""/200, 0xc8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x20000000, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})

03:16:36 executing program 0:
lsetxattr$security_evm(&(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f0000000140)=@md5={0x1, "df0c348b862d5f566f1d8ad04cb04491"}, 0x11, 0x2)
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:36 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
write$P9_RVERSION(r4, &(0x7f00000001c0)={0x13, 0x65, 0xffff, 0xc88, 0x6, '9P2000'}, 0x13)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r9 = syz_genetlink_get_family_id$tipc(0x0)
sendmsg$TIPC_CMD_GET_NETID(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r9, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x158100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x30, r9, 0x1, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0xdb, 0x2, 0x0, 0x40}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x1040)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r10 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r10, 0x0, 0x0)
ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, &(0x7f0000000200)={0x8, 0x7, 0x2})
tkill(r10, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  395.795329] binder: 16439:16453 transaction failed 29201/-28, size 120-24 line 3284
[  395.983198] binder: 16406:16418 transaction failed 29201/-22, size 120-24 line 3475
[  395.993494] binder: undelivered TRANSACTION_ERROR: 29201
[  395.997816] binder: BINDER_SET_CONTEXT_MGR already set
[  395.997825] binder: 16406:16425 ioctl 40046207 0 returned -16
03:16:36 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  396.034652] binder: 16461:16467 got transaction with invalid offset (150405120, min 0 max 120) or object.
[  396.049159] binder: 16461:16467 transaction failed 29201/-22, size 120-24 line 3379
[  396.060670] binder: undelivered TRANSACTION_ERROR: 29201
[  396.067482] binder: 16469:16472 got transaction with fd, 4, but target does not allow fds
03:16:36 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
r6 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0)
ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f0000000140)={0x8, 0x508, 0x2, 0x0, 0x0, [{r0, 0x0, 0x6}, {r6, 0x0, 0x40}]})
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
fsetxattr$security_capability(r3, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0xce, 0x100}, {0x80000000, 0x3ff}]}, 0x14, 0x2)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r7, r2, 0x0, 0x8000fffffffe)

[  396.088895] binder: 16469:16472 transaction failed 29201/-1, size 96-24 line 3427
[  396.115031] binder: undelivered TRANSACTION_ERROR: 29201
[  396.513692] binder: undelivered TRANSACTION_ERROR: 29201
[  396.516005] binder: BINDER_SET_CONTEXT_MGR already set
[  396.516013] binder: 16439:16453 ioctl 40046207 0 returned -16
03:16:37 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x1}, @ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/18, 0x12, 0x2, 0x22}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})

03:16:37 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00')
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000001c0)={@empty, <r3=>0x0}, &(0x7f0000000200)=0x14)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
getsockopt$inet_mreqn(r4, 0x0, 0x10, &(0x7f0000000240)={@multicast2, @rand_addr, <r7=>0x0}, &(0x7f0000000280)=0xc)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = socket$netlink(0x10, 0x3, 0x0)
r10 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r11}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r11, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
r12 = socket$nl_route(0x10, 0x3, 0x0)
r13 = socket$netlink(0x10, 0x3, 0x0)
r14 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r14, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r14, &(0x7f0000000100)={0x11, 0x0, <r15=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r15}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r15, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
r16 = socket$nl_route(0x10, 0x3, 0x0)
r17 = socket$netlink(0x10, 0x3, 0x0)
r18 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r18, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r18, &(0x7f0000000100)={0x11, 0x0, <r19=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r17, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r19}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r16, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r19, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4400001}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)={0x124, r2, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0xc4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r19}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}]}, 0x124}, 0x1, 0x0, 0x0, 0xa585bd858b17371b}, 0x24000000)
r20 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r20, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:37 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x400, @rand_addr="b4959fad19e29e81de7b8e5b64604808", 0x80000000}, 0x1c)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000f8050400"], 0x0, 0x0, 0x0})

03:16:37 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
mount$fuse(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRES64=0x0, @ANYRESDEC=0x0, @ANYRESOCT=r5, @ANYRES64=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:37 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  396.562303] binder: 16439:16453 transaction failed 29189/-22, size 120-24 line 3138
[  396.570252] binder: undelivered TRANSACTION_ERROR: 29189
[  396.593087] binder: 16490:16494 got transaction with invalid handle, 0
[  396.600756] binder: 16490:16494 transaction failed 29201/-22, size 104-24 line 3411
03:16:37 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
bind$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './bus\x00'}, 0x6e)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00')
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',gro]p_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  396.616921] binder: undelivered TRANSACTION_ERROR: 29201
[  396.634182] binder_alloc: 16499: binder_alloc_buf size -576460752303423344 failed, no address space
[  396.644361] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  396.654286] binder: 16499:16503 transaction failed 29201/-28, size 120-24 line 3284
03:16:37 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  396.664078] binder: undelivered TRANSACTION_ERROR: 29201
[  396.683087] binder_alloc: 16499: binder_alloc_buf size -576460752303423344 failed, no address space
[  396.684275] binder: 16492:16496 not enough space to store 0 fds in buffer
[  396.684297] binder: 16492:16496 transaction failed 29201/-22, size 120-24 line 3475
03:16:37 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="09379a802bc30c000000"], 0x0, 0x0, 0x0})

[  396.684848] binder: undelivered TRANSACTION_ERROR: 29201
[  396.721575] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  396.731294] binder: 16499:16509 transaction failed 29201/-28, size 120-24 line 3284
[  396.740860] binder: undelivered TRANSACTION_ERROR: 29201
[  396.779180] binder_alloc: 16517: binder_alloc_buf size 3592291329128352 failed, no address space
[  396.788655] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  396.798509] binder: 16517:16520 transaction failed 29201/-28, size 120-24 line 3284
[  396.808130] binder: undelivered TRANSACTION_ERROR: 29201
03:16:39 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = dup(0xffffffffffffffff)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40042409, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4)
write$P9_RLINK(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x47, 0x2}, 0x7)
r5 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r6 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r5, r6)
fremovexattr(r5, &(0x7f0000000140)=@known='user.syz\x00')
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
ioctl$UI_SET_EVBIT(r7, 0x40045564, 0x1b)
r10 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="66643d3af92e411f0151fc2505897abccac9cc8ef9c30091ae49c846cd7210b5fed1ef779f364dc3242a685891f2c1d4fddfa8431f3eed4ee07263b133a2ec5002689a8a76b6431948c80406ed85f131e423daa03606e740ab4457a081cd87b2758e4043158b66e0f88d0757a905bac3f03b40d5c45838ac1725e852ae9114d5060a960d4f0787f9594cc63dcd4da3d83544c34f7ca2a392299f770e3746bf6ce040dc78107f3613bf01c6a5290631ed8df11c65cf21555dd09b6e3174195bc17c82ee5d9ae413067bd558e551d7f891eef550d76704b12591c90b2469063a1f6532b9fff9cd571b22fbe4bf3867fb0ccab29dc02d50b2578806575982187e56ccd7fd5a3a7d5e6c210c9bada494c9797d071e41f82e2a17654f9ef13a5c20f30e4d2b04d559d63af2a2dc32b603", @ANYRESHEX=r10, @ANYBLOB="2c726f6f746d6f64653d3030303030303030c5a64f836638cf18b522de6b22799a5d303034303030302c757365725f69643d0000000000000000850b4d430a80e39518641aca4ba3f54f6b64c98835ce856d60945c54e491ecac7650d19a24ed0e2353fe3d4bd758015618b1fb50ac8eeafdadddc5e7ad391220ae3bc86295f28ebdb5515a43f54442ed425e79485ee38f2bf58d867ffa41416bfd8f0366295f0488c9", @ANYRESDEC=0x0, @ANYPTR, @ANYRESDEC=0x0])
sendfile(r10, r1, 0x0, 0x8000fffffffe)

03:16:39 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x9b09a4e88d43d94a, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfeed, &(0x7f0000000340)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x8, 0x0, 0x2c}, @fda={0x66646185, 0x0, 0xfffffffffffffffe, 0x14}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0})

03:16:39 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
fsetxattr$security_evm(r0, &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@md5={0x1, "4ca120207de33c7d3235f57c89568c4d"}, 0x11, 0x2)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000800000000001000000000000001400000000000000527ace6018eeaeb4c33775813fe074980a31cc29fd338c1c72f4622f360667304cb6054870f654bcb6f887c8984f410bc725bff1d87268d5287055ad070a3e61f0d25665489b96f9ebefc0a168d189621e5f6ff0d90fac083496cacf66c3a47ed170e1bb1da5c03c5882ca7e33b4a74364b582f05aaa8ec9d99f93aff44f60e5365b525b79b677c9446f5e41d7f8742a6a0c0e25f9e394807b2ec5e07989e2d98fed2e38ed72f77950720006b51e868d1b49becda47d96a8d8ed3fb021cd34"], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000002800200000007eda362f00001c4ce65d45dd99ee49b94724a00c6b87d3efc1879aa6edec6c7ac33fb99621645f99e5c8a962cf1a3d8a488e7e9b7781b25a41a48a3e5b9391d9391a18f13c9d90bc6a72f1c07f544fac8b689d7d1f8b90"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:39 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x208000, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000200)=[@exit_looper], 0x0, 0x0, 0x0})
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000140)=[0x9])
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000640)={{{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000a80)=0xe8)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x\x11k4\xd3\x1b\x05\xaf\xf0\x1eyRN\xc9\xc6V\x00\x02\x00\x00\x00\x00\x00\x00\x00', 0x275a, 0x0)
fallocate(r4, 0x0, 0x0, 0x110003)
lseek(r4, 0x0, 0x3)
r5 = syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00')
r6 = open(&(0x7f0000000400)='./bus\x00', 0x40, 0x1c4)
getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14)
ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x50, r7})
setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000080)={@mcast2, r7}, 0x14)
setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000040)={@local, @loopback, r7}, 0xc)
r8 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7')
sendfile(r8, r8, &(0x7f00000002c0)=0x202, 0xdd)
getpeername$packet(r8, &(0x7f0000000000)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14)
ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x50, r9})
setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000080)={@mcast2, r9}, 0x14)
setsockopt$inet_mreqn(r6, 0x0, 0x24, &(0x7f0000000040)={@multicast2, @multicast2, r9}, 0xc)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r10=>0xffffffffffffffff})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r11=>0xffffffffffffffff})
dup2(r10, r11)
r12 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=ANY=[@ANYBLOB="c4000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c1151ca678c9e6d000000000000000000000000000000000000000000000c001f00080008000000000092034fa5f3441f1bce700e4ab74d7c24"], 0xc4}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r13=>0xffffffffffffffff})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r14=>0xffffffffffffffff})
r15 = dup2(r13, r14)
ioctl$PERF_EVENT_IOC_ENABLE(r15, 0x8912, 0x400200)
sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x17100010}, 0xc, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYRESHEX, @ANYRES16=r5, @ANYRES64=r15, @ANYRES32=r3, @ANYBLOB="9000020040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e6365004c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c000400ff7f0102020000000500000700000000abed021f0000000008000100", @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYRES64=r10, @ANYRES64=r12, @ANYRESHEX=0x0], @ANYBLOB="4400020040000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e000008000100", @ANYRES32=r7, @ANYBLOB="b800020040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040004000000080007000000000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004005b4800003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="000102004000017bc20001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462716c010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004002bdb000008000600"/128, @ANYRES32=r3, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000000000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001400040080000202008000000600070601"], 0xf}, 0x1, 0x0, 0x0, 0x40}, 0x8000)
r16 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r16, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000080)={'sit0\x00', <r17=>0x0})
r18 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r18, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r19 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r18, r19)
accept4(r18, &(0x7f0000000380)=@hci={0x1f, <r20=>0x0}, &(0x7f0000000400)=0x80, 0x800)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, <r21=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14)
r22 = socket$nl_route(0x10, 0x3, 0x0)
r23 = socket$netlink(0x10, 0x3, 0x0)
r24 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r24, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r24, &(0x7f0000000100)={0x11, 0x0, <r25=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r23, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r25}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r22, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r25, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@ipv4={[], [], @dev}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r26=>0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f00000005c0)=0xe8)
r27 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r27, 0x0, 0x0)
r28 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r28, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r29=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r27, 0x400454ce, r29)
getsockopt$inet_mreqn(r27, 0x0, 0x11, &(0x7f00000006c0)={@multicast2, @multicast2, <r30=>0x0}, &(0x7f0000000700)=0xc)
accept(r2, &(0x7f0000000740)=@can={0x1d, <r31=>0x0}, &(0x7f00000007c0)=0x80)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000800)={'team0\x00', <r32=>0x0})
accept$packet(r2, &(0x7f0000000840)={0x11, 0x0, <r33=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000880)=0x14)
r34 = socket$nl_route(0x10, 0x3, 0x0)
r35 = socket$netlink(0x10, 0x3, 0x0)
r36 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r36, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r36, &(0x7f0000000100)={0x11, 0x0, <r37=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r35, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r37}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r34, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r37, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
getpeername$packet(r2, &(0x7f00000008c0)={0x11, 0x0, <r38=>0x0}, &(0x7f0000000900)=0x14)
r39 = socket$nl_route(0x10, 0x3, 0x0)
r40 = socket$netlink(0x10, 0x3, 0x0)
r41 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r41, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r41, &(0x7f0000000100)={0x11, 0x0, <r42=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r40, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r42}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r39, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r42, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
r43 = socket$nl_route(0x10, 0x3, 0x0)
r44 = socket$netlink(0x10, 0x3, 0x0)
r45 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r45, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r45, &(0x7f0000000100)={0x11, 0x0, <r46=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r44, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r46}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r43, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r46, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
r47 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r47, 0x0, 0x0)
r48 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r48, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r49=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r47, 0x400454ce, r49)
getsockopt$inet_IP_XFRM_POLICY(r47, 0x0, 0x11, &(0x7f0000000940)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r50=>0x0}}, {{@in=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000a40)=0xe8)
getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000b40)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r51=>0x0}}, {{@in6=@local}, 0x0, @in6=@empty}}, &(0x7f0000000c40)=0xe8)
r52 = socket$nl_route(0x10, 0x3, 0x0)
r53 = socket$netlink(0x10, 0x3, 0x0)
r54 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r54, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
getsockname$packet(r54, &(0x7f0000000100)={0x11, 0x0, <r55=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r53, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r55}, [@IFLA_LINKINFO={0x18, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x8, 0x2, [@tunl6_policy=[@tunl_policy=[@IFLA_IPTUN_COLLECT_METADATA={0x4}]]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r52, &(0x7f0000000080)={0x0, 0x1ed, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000011003b0e00"/20, @ANYRES32=r55, @ANYBLOB="0000759e2e7f0000"], 0x20}}, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000005540)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r56=>0x0}}, {{@in=@multicast2}, 0x0, @in=@loopback}}, &(0x7f0000005640)=0xe8)
sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000005d00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400240}, 0xc, &(0x7f0000005cc0)={&(0x7f0000005680)={0x634, r5, 0x400, 0x70bd26, 0x25dfdbfd, {}, [{{0x8, 0x1, r17}, {0x40, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}]}}, {{0x8}, {0x1c4, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x0, 0x0, 0x7, 0x7fff}, {0x7, 0x7, 0x2, 0x6}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r25}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r26}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r30}}}]}}, {{0x8}, {0x18c, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x8, 0x94, 0x7, 0x8}, {0xff8b, 0x0, 0x1f, 0x8}, {0xff, 0xff, 0x3f, 0xe4}, {0x8, 0x7f, 0x2, 0x200}, {0x927, 0x81, 0x80, 0x3}]}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r31}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r32}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r33}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfa1}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xc1e}}}]}}, {{0x8, 0x1, r37}, {0x224, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3f}}, {0x8, 0x6, r38}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r42}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r46}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r50}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r51}}}]}}, {{0x8, 0x1, r55}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4432}}, {0x8, 0x6, r56}}}]}}]}, 0x634}, 0x1, 0x0, 0x0, 0x20804}, 0x10000)
r57 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r57, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
ioctl$sock_SIOCGIFINDEX(r57, 0x8933, &(0x7f0000000100)={'ip_vti0\x00'})

03:16:39 executing program 4:
prctl$PR_SET_PDEATHSIG(0x1, 0x11)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r4 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0)
ptrace$setopts(0x4206, r4, 0x0, 0x0)
tkill(r4, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:39 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:39 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000040)={{0x3, 0x3, 0xffff7fff, 0x1, 0x9}})

03:16:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000140))
fcntl$getflags(0xffffffffffffffff, 0x9180c1ac162b5c74)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f0000000100)={0x2})
ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x2f)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  399.042677] binder_alloc: 16527: binder_alloc_buf size 66296 failed, no address space
[  399.043238] binder_alloc: 16529: binder_alloc_buf, no vma
03:16:39 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  399.043255] binder: 16529:16533 transaction failed 29189/-3, size 120-24 line 3284
[  399.043464] binder: undelivered TRANSACTION_ERROR: 29189
03:16:39 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:39 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="66643d741f6c40535e39ddc34b23c0335b310599bb80cf7a8ede110ffebf310f50b72e7fad4136a90ad2248e1f13661adfa153f93f06cb6947af77c5c98cb06fdf54f483b6f3692ae5d4067fe25c72189a3ce04d699129e7c00efa2eb3ad40ce4fd977e5318dc479d87cda32caffdb578ea00c56cbdd3b2c00edd63addeda3fb22191853052a", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  399.120832] binder: 16547:16549 not enough space to store 0 fds in buffer
[  399.120944] binder: 16547:16549 transaction failed 29201/-22, size 120-24 line 3475
[  399.121235] binder: undelivered TRANSACTION_ERROR: 29201
[  399.173551] binder: 16561:16562 not enough space to store 0 fds in buffer
[  399.173580] binder: 16561:16562 transaction failed 29201/-22, size 120-24 line 3475
[  399.173728] binder: undelivered TRANSACTION_ERROR: 29201
[  399.174538] binder: 16561:16563 not enough space to store 0 fds in buffer
[  399.174756] binder: 16561:16563 transaction failed 29201/-22, size 120-24 line 3475
[  399.174980] binder: undelivered TRANSACTION_ERROR: 29201
[  399.292842] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  399.302175] binder: 16527:16534 transaction failed 29201/-28, size 1-65261 line 3284
[  399.313923] binder: undelivered TRANSACTION_ERROR: 29201
03:16:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000edffffffffffffff000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x8)
ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f00000001c0)="8366cca7c763f652a2a9b28ff9df3ec6148667debca2af726069882e20d215f2ae12fe0bd17c0ed0b6c83f74fabf0db2f39d0330aa4bb6df7cb2387a2bb8afe56389fda65c1584e113ea8daa51bba59f42bebb631de8c6d642649f35a2b01619a6c88527d6d69b560cb560cef87906a755173df081e0546436831962382889d58f8d7070677411acf7c52ef2bc70d412ee3c7d8470")
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:40 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:40 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
clock_nanosleep(0x2, 0x2, &(0x7f0000000380)={0x0, 0x1c9c380}, &(0x7f00000003c0))
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x3000802}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, r2, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x20}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000)
r3 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726fa02636f01ff7618ebb1308000000643d", @ANYRESDEC=0x0])
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x1ff, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f0000000400), &(0x7f0000000440)=0x14)
listen(r5, 0x200)
sendfile(r5, r3, 0x0, 0x8000fffffffe)

03:16:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000140))
fcntl$getflags(0xffffffffffffffff, 0x9180c1ac162b5c74)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r3, 0xc018620c, &(0x7f0000000100)={0x2})
ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x2f)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:40 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = epoll_create1(0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@ipv4={[], [], @empty}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@multicast2}}, &(0x7f0000000040)=0xe8)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r5 = getpid()
fcntl$lock(r4, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r5})
listen(r4, 0x200)
getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@local}, 0x0, @in6=@initdev}}, &(0x7f00000000c0)=0xe8)
setreuid(r3, r6)
r7 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r7, &(0x7f0000000200)={0x80000002})
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0xfffffffffffffd60, 0x0, 0x0})

[  399.319640] binder: BINDER_SET_CONTEXT_MGR already set
[  399.324971] binder: 16527:16574 ioctl 40046207 0 returned -16
[  399.331358] binder: 16527:16534 transaction failed 29189/-22, size 1-65261 line 3138
[  399.339635] binder: undelivered TRANSACTION_ERROR: 29189
03:16:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x50400)
ioctl$PIO_FONTX(r2, 0x4b6c, &(0x7f00000008c0)="db1181037b30ed4fb9bb08b15f0e29d031573667738a95ae46f3b9017fcf49f95e0adbe640ee476a1b481a04a0cea9c7314b596580f6074a8d0772862eb27e4095261ad0193c64f7193e0b48889a1d135636b28b373ca705aa399399aa72248ef6a154c20234e6d77d6fa5e9ebc8d83a6d7997f66a7a0990060f7feaa25bde2a89f19778181556019a9358d213b46455c06c52b714050276a83ef85ed411d51c0681bc818e30db2ac0de7958526c2cab40b674a117caf4276f3f818755b2d5fc0e9d447256b9df7bc9a350f73c83b43730992beba06bd16560a3f727bee71b091bce78ddbcaa296aa1098a8ba01f0045c1f61f771a84f7def193da866f5a473d3a554e827f268f0ec2521d8038ff7d33fb05347de5d69b1a380bdf53cc824b3212de82b9b91625254e5874254f6f2e70c062ab3add912584c5fb427d838e3adedd1b9537b84e0164ba6eb576d68237d17baac5c351cd3c44030aaf02ec805368fa070d07a453929ebce09cbf4a53a142ec68542e02e8cab99da863e646d868d79375c7635c4f6dcd22b6f6ef776e86d7460121b17cb382bd78d9a55943d70a4ede7adc1e6b4146a4cbdde06bb34b6c4a926152ad199cc4e935d95fa6ec2a9595d68e17aa366e11a2483435ed78e26ce2fc6b8f7ad5ba8af0d6131293548a7496232d35db2793b074f6110868a181a0015ba92fb401ae9ad6ff58fdf29c6df1014928c9125a9806290b69f629668ca4df57d4647d4e47b2943aa14a02c0aa889b2d4f0995085dad6f71a91cc4ee4363ba71b3cd0016a8ce961648cd3246c2845a493ede122b1ac43b151886daba2bdcf0f9133fae44d62377f24d6e4ae376c913e3fdae40f43f1df5000bbc0f11165185c0306f81923a01d89176e21b8f934c004dc74f951d4953e601b7ac03b4ef9f9a22ecdb48596499fbd4943c25a2f5af1cfe60d23aede0aa9bfc83222ef461ea61849106135b1247f1dd5e778bded8d963ebe72355e200734259dac34a6fc565020f6d84812540fe17b1c71fd748570df6d394e4a7902cbc25842fe62648b8df350275e54ae02a0959b2ee6fdd79769ea782182bbde4ddd95ab578b14f5fc81932b8bdc9e0dd4ebf75698cf04bdb3b89b27d9b47bb362dc37b378b98878674e1b934583ba901dac20e1269d0dbab0a4d7e88ea908aab40126f9fa1d46e514708465069b5f99623f9b5cef09ef634026816464896bfd5d4e4e5c90fcda74a61aac518177a93168f5a5501df5f88915d48636442e92898b75f4f30069b318bbd040c63f8012d2642cd18e144353092efce7db5b82393965bc854698a0b13a7d9c72ac7c32423072925ada6ac860eaf48c9e5699298aa67edb104d1791dc1de7f1bc6cb4016253dadba10eabcc00a23d89cf878d6d1e1d1920e20cda7b79646cf2f53f8f445615a13ea35fe2a8929fd5306bdb0df94508c27ced436925a2328e5c13108d5c54459a9c60e34141f9d79f45defc0d068ff4feef007aa9e7a692e481d851e0c161d76c11e998f4a1fec11fa0b05e66a34633db14eb81f1bd2715d4b0ca827b89e9239451712c89c9470db4349516e1a7b0f919d4c041ec4190583d8e2bfebaac5e40788681f8713128e52d3fcd71522ad82f0c4ffccff1da44dccf418ba16314300d1664e7598fe38e2f40f184d4b410b2c48ea7de330681ef05b6ee0c791f5666869b9d2baa1d8d5ef8a71ecaa2775031862241f25b962bb982401cd8915d8132be469c5427ab395ad552a80688d1bd5336f9193bcc897c075f9c272bfe5531e2a456b8ee3b40acd598cf5eb2db4ca2e334104afe6b920587d8ae8b48b4eb6f3ef63d319ab33ae1d38fb0248ad192c2aa844cdec1fe9f85f8f62def66d5d44518d404d05a2cfc976c2c13b3ff01a03b3a64932e6a3c8757067a5f02f0e7accb5158d460b00a78ef84be8fbf28ec15275836f12a0cc8b79ecf339f575010f37fb585e5013b6910f10f5400c8b5f5b3266fc12ca04a0aa1f9a9803348c313050ccae5cb3d21235cff94f581a72a0a5a7bcee40e4d6ee176c6c8929fc5569b6003aa14f419f4bd4cf5f53f2c385261027b43c3c4e9f9bca6f801f50343605c1a1091aa8bd7a210518eb4cf66d6431cbff01ace244b9f64915e5206a5937e3608e48fc753da97500fec75264c840287709e6b5860ebff86dc01d7433531fb2f1d9ee365d66b255933f2f08c554ce1e1de7605bdc14d7ea25516ffbb816c814ed2f526855ffded7dba9028267ffd76e432e2622204f6ed3498660bc92f08f37e55f640eb93368e5cd519e6ebaacaedfed0e1c413d5b1b429201b22131aa2cfb648697cf2c3621d5e1ab1765e897e435d177374a474e58bd540b793e3d5e92a96b714fdcbd306393eac90cab920e39729c64b3095faa6bf12e0741569b64c29a58443af53458f79e8babdd48cc734ec3833210cc3f9c46be10edd4e22bd48371d0d60cbcc4a46d27afddfdd2f24d0b4b276e24fadfa889793fa966b8410e287b630fffd31230ba51f481f8d93082a683256bbb91e6f220dade1fee22c1448fd21ede714f6f58c860d043afa7e520fe4728f5f1515b7c8b6cb84ed8540992dee3f6311245c4a157519ebafec426387e5630c262c1f9e8bba66e9c1efc45dabebcc262596c8eae3223dd16e0ecb27e1e43011392a513681a210626ce29566f38fd95e0fd7f1556074ef0b039ad237a5746278e2fdc9d19550acd403a7944df04427a230477984df02887cbce3a7a7d4facac1f17990fa4d42b085b31b19cc21cb33e527941506bab128026532a528ef384edcec7aa08d4248218779f163d41755dfa7f8b6e1d5252d7ce20e315eeb633dea337d21f86c84517464a7501077e7f3b9cf31d80adb1babe4938f8bfd2b3afce231ffd40b7e81fd1bd600a22d685eb5d835f0d0bd2863ef5aa3d72e0e5476aa0fad31aad9e0ff493cf516200db1b25c0e9320f9a0ed59e9085a39bcec26ec4aae2f8def5897d98a06783db691d5e1bdfe579bed7fea35ebca435ef83c4860335c6a817df7a4da6a0e3fb8b1340d2310f1cf04aef0bc5bdad61362f937d258e56e4f63bda93ed402d9f60acf1c4ec8f447579f784db7bf031b4cfc3a2781c4d4771a04624c706203aafe887602b09b4350b102dd1cd7789a17da7c9ec5e4aa20ac25b94b79d6bad3d13324884d47f89570b849ef4e02aa9052d2fdd87ad217747d531c9d2bd7510a7e3475f217481609e4ff3139050e95b30e152f6080f40f11ca050fd7d2b19a3e9c68b8f9323954e08125d153198ae87aa7c9aa8d79524496f8f932b4ca818454fe37f209eb468b83b76078fdf520b36a470cd23544ee7674d2f0d2cee43974fdd3aeb5bdddcebea27b9e2cbf02643cf8c215f5d0cebc4e1404ba00aa5ca1f7e3cdc9357b1c85459211337f8863843ae77e392a270333e1959040e41a56c973276fc398a38265b088488f73b007ceb3edee89e24d3294342bf07d73af06c96215ecdd3cc097d36d910aaca0dd4d3f929fe518fd43adf494db6489eb64039e89890c84cd0205c964737eac0daa90da4ba9eee4de06cff2bc5b0e63a613b0d3535764668a92166b164f16adaa9621fae9e9872b182da9ec42d0dbd678d22342415648b120492cb2cf4306e1a914de8d72b231019b5e12116193bd6da081d06bd31a0211cb1e5190a8244ee1b02489ffaf0136fc6950f55e8475c72482615a797237ceee6ce2bd3cd2303404c8ed9a0fd56991532aa2d908cb90d47b62382d945148ded2c823392d72165a059acdc2c091428794e733df833f453f52de496962dd67dc845937e8c59fe038b13a94f7b0a28b71997084da6eb05eb7d66edc47d148ba662c307423145222739c6af3994ca52c693bd56918f816c9fb8c1aa8722799a0cf9dca3150c10586aa6938ec206f795f9c6f7df4d45eaed2c2e269a6e964ed25afe9a3ea5588e703a2addbe3cb7fd67e9460a0b223eb4f9d592b1fe706840e94d80fa12ade452f9391eeb385b99bec5930b54ff63dd6d36b78b02d12eb996143f56589e8961ab6e24c075cfe847afc35fd0fea35e0790515876b8edc0beafa2d45bcfe70a90b687975086d976ff03c705cfe5eede6bc4eac3533ec9baf343e61d24a4c6cec2df94cc6b5ce8bb3160ef912895031758db47b1f9cca654f57158f7a89aed28a6b06e6b5a840c37a2ccd2474bec9ae166f3a62d10b802ece7cae762a37574e5389012becd485614084da0ad06bfcff30713866ec8436c795812072e59eb6e1fe5e8a37fd6b148e3cbd0f07e9f9c4dd753266a5d79e738fb59396d9233512f06a84d6f75246927175ad52cbaf8236d68e89a4e771265ce2bd3d85b35bd1313885917c4a3a0a085d16a913e3add5534f2f7310942d8d42c7243324f8edfdb745bfa24a5207766abded37434038c37c49db5265c545e21b1dc1e7c260ac779200a106b82bc321f1a0d6e5c471585dea986cebec345fedda90e9a15675318d477ba0a60f558dee58cb1911e67f737d986e8e5dc1a6aa6737aee79620011add97b1c22db2035ccfb15454fe685c8bd3da94311ed0de1b48199b4cec549c12d1a176eaf89f7e77a9f92a2ea3e64fd954ea30571f29e5a75f1cb30591cda8dd988f262ca287827c7742098836c3b817dcd286652da3c98adbb48de11a14eb8c4321bd9305229f6702237b30682f087293b9ed6f1ae39ecdb122ea52be57b8e7eff669fae0bc2873ec19e62f6269feff213a4a309c5b67d654a27a84b049e3717806a40024f9cafd566973269d92c1585bf28b945e751d34712d5422ca5ce339dcadc1c2b256186311c5e68da85666d14d29c5ebe0941156d3090824d57aac80f988c8ed8c8f7e130373842cd60a872a7173855274018805baf134548a65dbe4fd563e7935300dbe0765bc29e3cc1d00f513783ad743396eebabbd4f5f1bae197a54739f998855d688df798b796cb19a61cf88332994d4a25435985e6d15b88a25b1c66e405bf09b75dacfd9049ae0223dda04b3d11da72f36dc81609db64e31b6bf6cf17c045961cbaf3eaaae3e999a45e1481cdd78039ae730e1e7eeee493fd9e21d767046c0734322636f2cc93824d4ef26db335798acaaa3bf675fd55f9da6032898bac458d2fad2ef2783c823dd46557be666dac15970e62f06bd76b5f66b5c5d107b45c753d6e2930175960c7570b33c4b77a9d73ebff47314136ba2380285bf57583ade1b5f302fa148c92871d448a83bfe20ad0b65ca97c751cef874e1c723279cc618fe7078ee7ba7da9eaf51373180eefa75ffc91527a3fc447894a305b47ee2f3065b509c72a303d0740bf412b16f7bcdd833b119c92ad1feae3ed1ed602e328f22b30b2f5eba44dc8926228430142ff70667c324b2660915b5cdb9ef9c2265e47a76e09b317fd8fa32221c4ae07bc24a2f918b56fc1b0f4a417b3bcccc30bc4befad84116f85ce2eb79e2a0a492c9055fe1f800628053cc596c0a40b0bd962c5c41ffeb43be63b17ed3c703c78564c744f349778b4094c6f44670ef3f88108f631d37cec268725c5e959b048bb78040a038876b13551593e8dec6bdaae1d07a01dc3489623e57e125ac3724cb65bb2c01122cdd9b4effb2c4a90788858dd25c91e0364d8f1355a131744677d6b719ca9fa9a2bd49bb8d88b047b5d1309f3d6f76d87b5af92dffa5325b5ce78e1a5130449e96468b1581db0516d94bcf04deef9e0ebb735469f3569292fa2673fe43fba84ddb43f83d91020c1768c510d75543db50dcd8f4e96322626aad1321a63759f435")
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x41, 0x0, &(0x7f00000003c0)=ANY=[@ANYRESDEC, @ANYRESHEX=r1, @ANYRES32=r3, @ANYRESOCT=r0], 0x0, 0x0, 0x0})
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x402844, 0x0)
write$uinput_user_dev(r6, &(0x7f0000000440)={'syz0\x00', {0xff14, 0x1ff, 0x0, 0xfff9}, 0x47, [0x5, 0x2, 0x4, 0x109, 0x3800000, 0x5, 0x2, 0x6, 0x5, 0x8000, 0x5, 0x6, 0x8, 0x4, 0x21c, 0x5e3, 0x0, 0x1000, 0x4, 0x3, 0x1, 0x8, 0xfff, 0x20, 0xffffffff, 0xc, 0x0, 0x1, 0x3, 0x5, 0x4, 0x3, 0xffff, 0x8732, 0x7ff, 0x4, 0x4000, 0x6, 0x10001, 0x7, 0x7f, 0x2, 0x1, 0x80000000, 0x3, 0x3, 0x3ff, 0x10000, 0x237f, 0x8, 0x5, 0x9, 0x83e, 0x7, 0xffff, 0x3, 0x8001, 0x1000, 0x9, 0x5a55, 0x8, 0x10000, 0x8, 0x71da5ada], [0xffff, 0x1, 0x9, 0x9d07, 0x3, 0xffff, 0x6, 0x10000, 0x3, 0x7, 0x600000, 0xff, 0x8, 0x1, 0x8000, 0x7, 0x7fffffff, 0x400, 0xff, 0x3, 0x5, 0xa68, 0x2, 0x333, 0x1, 0x8001, 0x4, 0x7f, 0x3, 0xf9ae, 0x0, 0x3, 0x1, 0x10000, 0x6, 0x7, 0x1, 0xffffff9b, 0x8, 0x7ff, 0x0, 0x6, 0xfff, 0xfffffff9, 0xfffffff9, 0x1, 0x8, 0x178, 0x3, 0x6, 0x80000001, 0xfff, 0x9, 0xa6, 0x9, 0x2, 0x3, 0x4e712369, 0x4, 0x6, 0x1, 0x9, 0x8], [0x3f, 0xfffffffc, 0x76b, 0xc75, 0x271, 0xffff, 0x7fffffff, 0x3, 0x9, 0x2, 0x9, 0x8001, 0x7ff, 0x7, 0x1000, 0x9, 0x1, 0x8000, 0x6, 0x7ff, 0x9, 0x2, 0x7ff, 0x7, 0x2, 0x7, 0x10001, 0x6, 0x1, 0xfffffffd, 0xfff, 0x9, 0x0, 0x3f, 0x7fff, 0x9, 0x3, 0x7, 0x4, 0x5, 0x80000001, 0xfffffff0, 0x81, 0x3, 0x4, 0x200, 0x1, 0x101, 0x9, 0x4, 0x7f, 0xffffffc0, 0x9, 0x8, 0x1, 0x1, 0x3, 0x0, 0x8, 0x5, 0x9, 0x3, 0x7, 0x9], [0x8, 0x80000000, 0x4, 0x3, 0x7, 0x7, 0x7fffffff, 0x3ff, 0x20, 0x8, 0x8, 0x6, 0x103, 0x7ff, 0x3, 0x4, 0x0, 0x1f, 0x3, 0x401, 0x40, 0x5, 0x60, 0x400, 0x7, 0x3, 0x8000, 0x329, 0x0, 0x8, 0x6, 0xf9, 0x1ff000, 0x81, 0x7cc, 0x0, 0xfcac, 0x100, 0x1000, 0x10000, 0xb, 0x8, 0x1ff, 0x4, 0x8e9, 0x4, 0x20de, 0xffffffe0, 0x1f, 0xacc, 0x6, 0xffff, 0xfff, 0x25, 0x7, 0x1, 0xa5cd, 0x7, 0x40, 0x206, 0x7ff, 0x2, 0xff, 0x8]}, 0x45c)
ioctl$sock_inet_SIOCGIFADDR(r6, 0x8915, &(0x7f0000000040)={'tunl0\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}})

03:16:40 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  399.373393] binder: 16576:16582 not enough space to store 0 fds in buffer
[  399.377418] binder: 16575:16581 got transaction with too large buffer
[  399.377441] binder: 16575:16581 transaction failed 29201/-22, size 120-24 line 3493
[  399.377643] binder: undelivered TRANSACTION_ERROR: 29201
03:16:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
fsetxattr$security_evm(r0, &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@md5={0x1, "4ca120207de33c7d3235f57c89568c4d"}, 0x11, 0x2)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000800000000001000000000000001400000000000000527ace6018eeaeb4c33775813fe074980a31cc29fd338c1c72f4622f360667304cb6054870f654bcb6f887c8984f410bc725bff1d87268d5287055ad070a3e61f0d25665489b96f9ebefc0a168d189621e5f6ff0d90fac083496cacf66c3a47ed170e1bb1da5c03c5882ca7e33b4a74364b582f05aaa8ec9d99f93aff44f60e5365b525b79b677c9446f5e41d7f8742a6a0c0e25f9e394807b2ec5e07989e2d98fed2e38ed72f77950720006b51e868d1b49becda47d96a8d8ed3fb021cd34"], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000002800200000007eda362f00001c4ce65d45dd99ee49b94724a00c6b87d3efc1879aa6edec6c7ac33fb99621645f99e5c8a962cf1a3d8a488e7e9b7781b25a41a48a3e5b9391d9391a18f13c9d90bc6a72f1c07f544fac8b689d7d1f8b90"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:40 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r2 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r1, r2)
fsetxattr$security_evm(r1, &(0x7f0000000200)='securit\x7f.evm\x00', &(0x7f0000000080)=@sha1={0x1, "2e55de1a7620748515a14575b063da465fb77dd9"}, 0xfffffffffffffeb3, 0x8b03b79971be6dc8)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c)
ioctl$RTC_SET_TIME(r4, 0x4024700a, 0x0)
preadv(r4, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000100)=[@request_death={0x400c630e, 0x1}], 0x23, 0x0, &(0x7f0000000140)="0aed995a8e593ca9646e4d51f6efa46e10f7f09bda2de1b5755cc317007c66f54ef4f6"})

[  399.386155] binder: 16575:16585 got transaction with too large buffer
[  399.386180] binder: 16575:16585 transaction failed 29201/-22, size 120-24 line 3493
[  399.386443] binder: undelivered TRANSACTION_ERROR: 29201
03:16:40 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:40 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:40 executing program 5:
setxattr$trusted_overlay_opaque(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)='trusted.overlay.opaque\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1)
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000500000000000028000000000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000280)=0x5812, 0x4)
writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)}], 0x1)

[  399.407610] binder: 16583:16588 unknown command 0
[  399.407618] binder: 16583:16588 ioctl c0306201 20000180 returned -22
[  399.420980] binder: 16587:16589 not enough space to store 0 fds in buffer
[  399.421008] binder: 16587:16589 transaction failed 29201/-22, size 120-24 line 3475
[  399.421615] binder: undelivered TRANSACTION_ERROR: 29201
[  399.464370] binder: 16593:16601 unknown command 875837489
[  399.464379] binder: 16593:16601 ioctl c0306201 20000180 returned -22
[  399.478000] binder_alloc: 16599: binder_alloc_buf, no vma
[  399.478131] binder: 16599:16604 transaction failed 29189/-3, size 120-24 line 3284
[  399.478532] binder: undelivered TRANSACTION_ERROR: 29189
[  399.486329] binder: 16600:16603 not enough space to store 0 fds in buffer
[  399.486355] binder: 16600:16603 transaction failed 29201/-22, size 120-24 line 3475
[  399.486756] binder: 16593:16601 unknown command 875837489
[  399.486780] binder: 16593:16601 ioctl c0306201 20000180 returned -22
[  399.488749] binder: 16600:16603 ioctl 660c 0 returned -22
[  399.491353] binder: undelivered TRANSACTION_ERROR: 29201
[  399.593198] binder: 16612:16615 got transaction with invalid offset (1280, min 0 max 120) or object.
03:16:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000008000000000000000000000000000000000000000000000000000078000000000000001820000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="3358a9e60e8e1017da847a5f2e349f8a83ac348ba5b6698ab7033459ef457cb9de03188d7e5f9c3f654df2458f9b1926b3bf4d1c8fea886fb7f33df9b1a3f516e0f588237a676be87ac05ba485e23ce160671226e9813becd1f4e9b0cc70ee9a75a8218c5e73a0c3db27736ef9865500"/123], 0x0, 0x0, 0x0})

03:16:40 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0xfffffffffffffffe)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0xd8f}, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  399.593224] binder: 16612:16615 transaction failed 29201/-22, size 120-24 line 3379
[  399.599531] binder: undelivered TRANSACTION_ERROR: 29201
[  399.644471] binder: 16576:16582 transaction failed 29201/-22, size 120-24 line 3475
[  399.654343] binder: undelivered TRANSACTION_ERROR: 29201
[  399.660678] binder: 16576:16620 not enough space to store 0 fds in buffer
[  399.668054] binder: 16576:16620 transaction failed 29201/-22, size 120-24 line 3475
[  399.676708] binder: undelivered TRANSACTION_ERROR: 29201
[  399.708448] binder_alloc: 16621: binder_alloc_buf, no vma
[  399.714400] binder: 16621:16623 transaction failed 29189/-3, size 120-24 line 3284
[  399.716459] binder_alloc: 16622: binder_alloc_buf size 1661984457150265544 failed, no address space
[  399.716465] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  399.716480] binder: 16622:16624 transaction failed 29201/-28, size 120-8216 line 3284
[  399.716603] binder: undelivered TRANSACTION_ERROR: 29201
[  399.717463] binder_alloc: 16622: binder_alloc_buf size 1661984457150265544 failed, no address space
[  399.717470] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  399.717486] binder: 16622:16625 transaction failed 29201/-28, size 120-8216 line 3284
[  399.717698] binder: undelivered TRANSACTION_ERROR: 29201
[  399.789339] binder: undelivered TRANSACTION_ERROR: 29189
[  399.795407] binder_alloc: 16621: binder_alloc_buf, no vma
[  399.801181] binder: 16621:16626 transaction failed 29189/-3, size 120-24 line 3284
[  399.809451] binder: undelivered TRANSACTION_ERROR: 29189
03:16:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
setxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)=@known='system.sockprotoname\x00', &(0x7f00000001c0)='/dev/binder#\x00', 0xd, 0x2)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0)
ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000240))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:40 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = accept(0xffffffffffffffff, &(0x7f00000001c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev}}, &(0x7f0000000240)=0x80)
getpeername$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0xffffff2c)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0xa0002, 0x0)
mkdirat(r2, &(0x7f0000000140)='./file0\x00', 0x6031494fa3c1ead)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:40 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000000))
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$BLKPG(r5, 0x1269, &(0x7f0000000280)={0x5, 0x80, 0x39, &(0x7f0000000240)="9fb80deb31536151de57aedc5077f4eb6b5502c3a99d9c891f25bdbf65bd1854b22b738b116dec4e40240fd990715e356f72cc48dd138648cf"})
r6 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r6, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0)
dup2(r6, 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0d630000056304400100000004630440010000001163484002000000000000000000000000000000000000001800"/72, @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00'/113], @ANYBLOB="000000000000000000000000000000000200000000000000852a646600000000", @ANYRES32=r5, @ANYBLOB="000000000000000000000000852a6273000100"/36], @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="8004000000000000"], 0x0, 0x0, 0x0})
r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r8 = getpid()
fcntl$lock(r7, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r8})
listen(r7, 0x200)
ioctl(r7, 0x7, &(0x7f0000000100)="f792efd0b4def4d656e4e216f79eb43c2c132a6f8705285bd75545caf622361332d27aaff65bb82ce707fc5b247be2c8ace47338aa7682a226d64892e4f699ee65ea6a12ad7bf69885a9778988fd32a713ba6754cb075d8414a04e2adbdd1a")

03:16:40 executing program 0:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, 0x0)
ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40004580, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xba, 0x0, &(0x7f0000000f00)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000050000000000000001800000000000000f090ca42e6529151f7d6c088b078fcc863bc7faf9543207c84555891ad062a52a931edf719466e65af45e2db1b9165f218456dc6c43b60654de5c3d23be751b85c20181c807c74e11a57f3e6c7c927d928feba85aa6779e0ad370c53c4722d2ab170375ae70173a80790ccf010dc7fd137f418b56c9f5f6ef2ab124afd93a0290cdd9c22b634"], 0x0, 0x0, 0x0})
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000040), 0x4)
fallocate(r2, 0x0, 0x0, 0x1000f4)
r6 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r7, r6, 0x0, 0x8000fffffffe)

03:16:40 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = dup(r0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f00000003c0)=""/4096)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x13)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  400.197369] binder: 16634:16637 not enough space to store 0 fds in buffer
[  400.206596] binder: 16632:16635 not enough space to store 0 fds in buffer
[  400.206628] binder: 16632:16635 transaction failed 29201/-22, size 120-24 line 3475
[  400.207123] binder: undelivered TRANSACTION_ERROR: 29201
03:16:41 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  400.227198] binder: 16636:16640 Acquire 1 refcount change on invalid ref 1 ret -22
[  400.227258] binder: 16636:16640 IncRefs 0 refcount change on invalid ref 1 ret -22
[  400.227265] binder: 16636:16640 got transaction to invalid handle
[  400.227272] binder: 16636:16640 transaction failed 29201/-22, size 0-0 line 3138
[  400.228087] binder: undelivered TRANSACTION_ERROR: 29201
[  400.238663] binder: BINDER_SET_CONTEXT_MGR already set
[  400.238670] binder: 16641:16644 ioctl 40046207 0 returned -16
[  400.239024] binder: 16641:16644 got transaction with invalid data ptr
[  400.239054] binder: 16641:16644 transaction failed 29201/-14, size 80-24 line 3316
[  400.270611] binder: 16636:16640 Acquire 1 refcount change on invalid ref 1 ret -22
[  400.270619] binder: 16636:16640 IncRefs 0 refcount change on invalid ref 1 ret -22
[  400.270626] binder: 16636:16640 got transaction to invalid handle
[  400.270634] binder: 16636:16640 transaction failed 29201/-22, size 0-0 line 3138
[  400.279224] binder: undelivered TRANSACTION_ERROR: 29201
[  400.290372] binder: 16646:16649 ioctl 5423 20000100 returned -22
[  400.290731] binder: 16646:16649 not enough space to store 0 fds in buffer
[  400.290755] binder: 16646:16649 transaction failed 29201/-22, size 120-24 line 3475
[  400.290997] binder: undelivered TRANSACTION_ERROR: 29201
[  400.297828] binder: undelivered TRANSACTION_ERROR: 29201
[  400.304989] binder: BINDER_SET_CONTEXT_MGR already set
[  400.304997] binder: 16641:16644 ioctl 40046207 0 returned -16
[  400.326429] binder: 16646:16649 ioctl 5423 20000100 returned -22
[  400.328091] binder: 16646:16651 not enough space to store 0 fds in buffer
[  400.328118] binder: 16646:16651 transaction failed 29201/-22, size 120-24 line 3475
[  400.328436] binder: undelivered TRANSACTION_ERROR: 29201
[  400.463403] binder: 16634:16637 transaction failed 29201/-22, size 120-24 line 3475
[  400.473669] binder: undelivered TRANSACTION_ERROR: 29201
[  400.480664] binder: 16634:16658 not enough space to store 0 fds in buffer
[  400.490622] binder: 16634:16658 transaction failed 29201/-22, size 120-24 line 3475
[  400.498811] binder: undelivered TRANSACTION_ERROR: 29201
03:16:43 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:43 executing program 3:
stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r0=>0x0})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
fstat(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r3, 0x0, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r5)
fstat(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
r10 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r10, 0x0, 0x0)
r11 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r12=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r10, 0x400454ce, r12)
r13 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r13, 0x0, 0x0)
r14 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r15=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r13, 0x400454ce, r15)
getgroups(0x6, &(0x7f0000000300)=[r0, r2, r6, r9, r12, r15])
r16 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r16, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r16, 0x40046207, 0x0)
r17 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r17, 0x0, 0x0)
r18 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r18, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r19=>0x0}, &(0x7f0000000240)=0x8)
ioctl$TUNSETGROUP(r17, 0x400454ce, r19)
mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r17, 0x0)
r20 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r20, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x73edd61aff78e539, 0x0, 0x0, 0x3d8, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:43 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0xe6cd424c49745644)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@broadcast, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8)
ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f00000002c0)={@empty, @mcast2, @mcast2, 0x8, 0x0, 0x1, 0x300, 0x100000001, 0x20400, r4})

03:16:43 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:43 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:43 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x5)
bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', r0}, 0x10)
syz_open_dev$binderN(0x0, 0x0, 0x0)

03:16:43 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:43 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000340)='./file0\x00', 0x10)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
getsockname$unix(r0, &(0x7f0000000040)=@abs, &(0x7f0000000100)=0x6e)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = getpid()
fcntl$lock(r3, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r4})
r5 = getpgid(0xffffffffffffffff)
tgkill(r4, r5, 0x29)

03:16:43 executing program 5:
syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x200000, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x20000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r3, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0)
getdents(r4, &(0x7f0000000280)=""/135, 0x74f)
setsockopt$inet_opts(r4, 0x0, 0x9, &(0x7f0000000880)="fd2400638d17d3181a16daa2e6be8cda4bcbb5748b6af6fdbc239e19b02872a01e87b9f644fb2f58a3d2c8aa28216832d76988c746e0d1f711bfa970b48584df80ab59dd02e4ab4bf413daf78ad6fc269b9b8b5f1c236f309cf9a59ab6cd29e6fd325958005e73227ecc4cb44d29455b91503ac5ea023495e79c786911e2b18c7b4375140809332340e3e0a628c4e6b139fe2ca959791835ad0e6f6d4835eb3fc874ffd527274479d44bd6bacd56f6faf36ebe45db438459f58042a8c3bd2a5c51d59f1e", 0xc4)
fadvise64(r4, 0x0, 0x800, 0x0)
lseek(0xffffffffffffffff, 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000800)={<r5=>0x0, <r6=>0x0})
recvmmsg(r3, &(0x7f0000000780)=[{{&(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)=""/231, 0xe7}, {&(0x7f0000000000)=""/40, 0x28}], 0x2}, 0x9}, {{&(0x7f0000000340)=@nfc_llcp, 0x80, &(0x7f0000000440)=[{&(0x7f0000000400)=""/18, 0x12}, {&(0x7f00000005c0)=""/162, 0xa2}], 0x2, &(0x7f0000000680)=""/220, 0xdc}, 0xd80}], 0x2, 0x40, &(0x7f0000000840)={r5, r6+30000000})
write$P9_ROPEN(r3, &(0x7f0000000040)={0x18}, 0x18)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = socket$inet(0x2, 0x4000020000000001, 0x0)
bind$inet(r7, &(0x7f0000000200)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r7, 0x0, 0x0, 0x20000800, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10)
sendto$inet(r7, &(0x7f0000000000), 0xfffffffffffffccf, 0x3e8, 0x0, 0xffffffffffffff37)
ioctl$TCSETXW(0xffffffffffffffff, 0x5435, 0x0)
prctl$PR_SET_THP_DISABLE(0x29, 0x0)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x40, 0x0)
sendto$inet(r3, &(0x7f0000000480)="8b", 0x1, 0xfffffffffffffffd, 0x0, 0x0)
recvmmsg(r3, &(0x7f0000005d00), 0x2, 0x0, 0x0)
stat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0))

[  402.551391] binder: 16659:16664 not enough space to store 0 fds in buffer
[  402.555821] binder: 16660:16662 transaction failed 29189/-22, size 120-24 line 3138
03:16:43 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
write$P9_RMKDIR(r1, &(0x7f00000002c0)={0x14, 0x49, 0x2, {0x10, 0x4, 0x5}}, 0x14)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
syz_open_dev$rtc(&(0x7f0000000280)='/dev/rtc#\x00', 0xe7, 0x20001)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x129080, 0x0)
r2 = dup3(r0, 0xffffffffffffffff, 0x80000)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000480)={'rose0\x00', 0xe3bdbf713b93024a})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r4 = add_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb)
r5 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$IOC_PR_CLEAR(r6, 0x401070cd, &(0x7f0000000440)={0x3})
ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000000400))
keyctl$restrict_keyring(0x1d, r4, &(0x7f00000001c0)='cifs.idmap\x00', &(0x7f0000000200)='bdev%(\x00')
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000003c0)=0xffffffffffffffff, 0x4)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000cafeffff0000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00002007828d4bcb"], 0x0, 0x0, 0x0})

03:16:43 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  402.557334] binder: undelivered TRANSACTION_ERROR: 29189
[  402.561108] binder: 16660:16670 transaction failed 29189/-22, size 120-24 line 3138
[  402.566161] binder: undelivered TRANSACTION_ERROR: 29189
03:16:43 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='fu3e\x00', 0x0, &(0x7f0000000800)=ANY=[])
r2 = geteuid()
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r4)
chown(&(0x7f0000000000)='./file0\x00', r2, r4)
r5 = getegid()
r6 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
sendmsg$nl_netfilter(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000001840)={0x1210, 0x6, 0x8, 0x800, 0x70bd28, 0x25dfdbfe, {0x1}, [@nested={0x11fc, 0x1f, [@typed={0x4, 0x80}, @generic="5cb637f1b13d8fa7ff1ef6bd019cc6885742a767a57340a0eb8951fcd74ea40715f5f06c95348b79203bd924dd372ef61d79c95423546db71d5170be1e679280cf537176247cf1c47c62e379163e22acd9667bab153ed00d1817ad45cc305b99626e73380ca0cadb29edecfbbda7776f8ab53bfb9687b49a60f8da0a75023f690cc7289702d2602a1702cf75de934f9183877d216d1599c18ce1abb1e4cb9acff55fe8c33d7cdf2bbde1821aadc1f2efda02498c8800c2bcee4aaff567c6b58e50499252c7e1750144ecc0dca28e45e5be1403ee5177cc0789c6f7cec45db62578d87e057c85dd99fc56afb1d9bc7d832f171a081e968495bff83ef3128a9c91b6b9a2ff6e0a13d110e32d8f49e3ec29adbffa5c3af90710aa6d9b4d1dfbe92081d739ca583ab87a1e08cd38db1c48f0e50db893a14392152e73f7bb8b63fb8c32582d74119047c5062d0e141a952598d6a9c62ae72f2c56781e30e15299e289081c79189c8116b889cb62fdd4236c2f53ed5d3bcc9e0cbfc3cb37807000ddab1b3d2cffad7169e985b09a3f044129765e294841889b46d502aa8829d0c852e374fa0e9c6bc5576f127e104603a81920bc603564a9cf285b27e43e292ad41e97f8c84abcb782a94460d86b80f643b21933c9abb61f041701325c1533b56bd2d2e806ef0bc1b262cf89dd98358680e7f88c816fe00900f4dbdba74da10d73e22db69bec0efd20e958a6545de9698d77df8cb0090f8c5cd59906325fd17df95b37bddca45bc58aef43a5076b39fab1c57774d245f8a2056eb0933cd64e690699fab6c67a36ac4f2146330ff01af8adace111b4557cb5f3d9a806ec585bbff437824f0e9a786776d72c746fdc317e182239cbb0831e8cdc210241dbc73a4c782b81254359f27058172cfa9def15b89ff6fb24e4924f541a29873bf56fb9a797c2f8c9cf9f6dbd7a5fc238e5239f68f3742b49f0a624db3bd26f86c0c3dc775f417b8e2f98410574aa524914dffcd0a143a84d34c4e0436b1c093c3be2e18235acbee05b60ae887f2e2e0401d1f3c704fc565a65275d205a73efb0348e7d00214fdd577445ac5ce92bb2bd5ec1fa620062bc2fff28740ec0dcd7a25649c5b01e1bc8281e03d1f1015d1a86c60f025fc2de1a4cc0caf6d2919179099dd52f97b1d63d4ff3d8c27e7f9f6b0742edaf0ae789c912d1cf98cc30e5e13f710202a5943e639ab3b4c486c8c4e98b337ba23fab1de5424a6ad5716f86819910bcf92d6739a411057adc594557400b0f13a2569469108eded7fb36026e46a0f2597b78b32c29535259a3e09bdf30b4490a894ecd3099a190f9869dead1d8e068c776394a7c7d48c30943a5f2f45c3ae9be9700e38e9469ec6b65e011336e1d819550fcae4d5fe679337152ad55a2bad77ae723abab0ae7299ce949ce5531d98d2ba2bc19e771506902922378c9856dc07b91251a410b3d8dd9ef7b85455396fb88eccf80975b847abce0f6b8043daf0ed7400862384e91d3d522d609038f779bfac46d3195c6203ccb8ba835601b56a2d25baf7eaa62bfbed3e1c2725b7b1354e3fa23ed154064fedfcdb9b6888c359c5b6c901c73cb13a4c340205c62ca1beb04f99b9ae3dac1e7a5305f61b22c88054ab7abf2deae7657fe1ce2c8f6ea7ce15e7da9f08f20d70814834b5849a156900d512825943ddda9ce0e96b943e61c0da4c97e854f7fa73c0861fd74164647bd9a468f5c84482dcce29620c7f5363802230a102b64b4d8c2dfdbbef73e2e0b0d964df0f3a9724478c9888c7c3490982990227ee6a475da87965a64a9908d17fd2d939530453161f78ddecef6e85046319df2f16796d03ad5cfde6325d78e6776f8588e1329e58f485a004c13c1407892ef5a76b52119aaf1825ea105380891498fc1c96a87f02c4799ebe61b24104fe51fd37dfe5b01d7046b30cbed2418dad44f46fb86a945408d72ee8d958d2be37f610b8aabe49cea1676b5417d76e8902bed64bb7ab4309b8bdd78c1f1dabcc95d35e16981302ea24f197c9c8134fd2d6991696532b9a1f1a6a1e0b4303a88135893b2e667892ff1916d54d65ba2cf1998b0e4759b6a91c912117ad083f5b05604b7c8adc800964ea8a93bdb780700454ba47a9f7a3cf392b0be15de2c3ede2165880f011d1cfdc49d1ca9236cace9daa3b3dfefae7f4506d30d3345368271f6df7366de12ae8ef46b3a32d0c352233904c99dd680fcffbca53baff09793f40ffdc7f407db720f5ec3baadaea1b57b17f279120622c0084247dbcb2cf6361195bceb4bdbb0dbd8592edabc64b0a192d0cb7644edbe0a998fb0f3e6b61040bb1362c11ec793e12ebffd6d69a691d33d39bac06a6dc2fa7570bf394cbf450dee848bef5a965141d56c661686ae220c315e9cb9e46013e4efed7630dbeff7fc47511064b4567a731ea0d1735a963cbd70246ec423cf5a339cd4b5d18eb03826beba1e914b7e59762c786f4271dc82b07db5a0bc62bb8c7777ed4cc48b04d16283e1a3c94d6a2e9a14fca634096e27ce946e2eb7b135955afaa693abb3626752c9f67e6d31653e2d26810e350ba85c7cca2f902502c2635bdb5ad6015bf9c5f98b255d0fd9c93b34d5c29b81f9a72fc59f02a64ab7e8b14db687274b4729e2324ea4a814f7f8aa989a8fd9a24075bd844d0fc34f817c21e23dd0e60ca8b24c00e8c36ebe68ac848f446e5e8e570c8d9ea8310cbb4f31f07871771afdb97d67d24bcf2915361f8edba567f21dda51f74d9f37144db8c41e416d1c0552fda2d2335c167d7036e3bc15bbf458a6fcc9140fd71ba1565f3affbfb3ab12bf01f02468a0ef867a4fcfb3f61db34a6a130c2720b6e9a7824dc6338a11b756e70462b73f79dbeb8125e4ebba1ac607c8610d38cf90ed730d2e8024d08cba9e86e83aa8afe2ed02e19d19bec54c8b14e8810e05366c62a662e3cdd0d0f7389389058f9d0dd2cee659d3cbc3f9a9830412ddd301c53fd7c9d8ae54062ec68580b15f26e50de6048bb64cd404ae1253a3d16fb3d6cb0cf1578803a678ef9e6e9d0de776f72f7a2d83292e942aafd7a80b19dd6c056f3aec8c0b94e8a8834ceaa90d7fee9f82aea6f901c22aa300d63531c7ab5b33e3ea3d493b1b58e0971dec43be4ad18809e35b235f2869a0f69b9cf7c2b6ad436504278dc25ef5ee55a46ce83e5c0c0acf2339dcbf1ef31c2e7fb0197c6592c362a15bb0f1e811c92966dcec972a591915a542d802189f0708f678cedc95276ee89d1695cfe138c9dba790f6e3b8580a7f20a0522763a9f442705d2ef81d25f718d451b225b0f74c5b99015da298b934c3f08af3f2e13c43fc49667b0465883f1bc3738a49145f433ae7f5488f17af3684a7e2a01743ddee1a2b6cb98a2086f4797c15bb3cebe22fff55a5fe5734d606a0c28b5e89ee42d49e71ada3a8b544f3c15f0b5286ec92ef060aaeaa6613a265909498fc66d5cf1c7d45e86ba3b4aeb43f8455f1b0e973785988fe8179f18e8d818893524034c5f07a27f78e83330756d619a6aba5dc4a4cddc782a9a07402ad2c2872e5f56ee28533c402fa3f4aeaabb3012ff42cf10e6b8da599aed2f9cd650e31ca70e61077ed6f9059fac7e921a6b84db98f91c636e07525fccacb7e685acbff1a86cbb39e4d84d0ff37f2accc67e19bc1f7b2626369a7ee831c2fe9428d98085bcb01f464ee690fe46c71aec0daebac970c41b815c755b39f4e7f661dc7b9f7aef4af2d001a5d00efbea99c4f7ec6721aefcf9867ae7ad5c9f3a2c4c836d7667ef75956aaa77b8b6a8d7f65390c720268ee4156be12cbd70536a8375351c59045652651af8c99890ec187391468a4675e70aabadbfee203c59acbc999bc9a44100b3d85ee228aad2bcff02cc8599a72e01b56e7acb58fe8c40476fa2b37d1039cd0d93906fa2385d29b870c7a71e818b57e7add1765d11d6e0f7a2dea6c5a59fa30b657950f41c3d7615a2d2cb14f4c7b068b3ff00e0b5bd3174499712b8a147019b7fb662d7c121cbe8178c2cd5ef28cdde4c1a1f3f1f0b83e94ffb79b8a1a788115a57f91e858070082c2ada42ff3b84cb313be8d5546fb7c96cbc8d67f2d859925e0c01dbdcd827be4a6d50564cf8c7dd6e8f6dcc1edf7d27601a7cf9e67c44253788caa1fd703c211c7bce10b2818a4a851a205417de80d26399afcfcfcf65bd07e99bb5c3252099c30776f14391b8f798595e9738fd29ed8376f9910870876b388a9f62a4fbc50ba52be1339b0004cf71fb4ed7730ab8303c733681c26d1690998bb4b273c8b6db9bbeded96dd5622bc6b290c05d23038af29710b0680141b5349fa95aab98911c428e12af1af4aab192acfee9740445052e8bbae39e39fbc3b51306b3502ea574a4cef484430bf16f5024744f4febcbc338326eef6d1d8824cc646d4b7f4ebf7887eab6a9db90fa47224100d378207d9fa5028bbd6fa649f5d2b002e1eae40c365b872812339bc16605cc13643ba984dfa4c01a1057f55583174367bacc125ea7f4368886b605e77a5b6e13498a2f433ab535455ea66f419990c3f0c1525e95abce71386a894093813e545ef6efb80d270b9f83066c22dcbbd7a9ff3ea634e7b3b28b5350c2a77d70e1b3623cbf3435e1483899579b7a859a3a1c63078e2be2be83cd3a56b841513bfc8ab87232c7334a50c0cb37edc427d746cf8c2961493b872c392167264f0bfd52f48dd99705455da5ee47c6e01ba8730074c5a9bc30f347d1a42562119fff5a3e807bf53fa0661527683c14be001994ffcfc6bc9c69943c8adf50f07ab4f5260642b17f22503652573eb05c498eac6fb073452d00ee36107260178085100f0df4e390c89f2c5855cd7e3fc9594527412c7893d485f7819c6bc1a6093915d3a19d368286c65ffb9e936def3a3e3e2741c2448ca8d9fa276f658f78449a3b3a72d5899955210a1802584bd93b42d2e2f18d40303bcf177647946bf5d00f34004b3b35661e1e135c47de2f8549dd16dca4f9bc555fbcfb65426d16494bd915c50ab45a708ad61efe4648338d0a261dfe592598308b9753610651c7b21ec996bbc0209566b5268b26befe15da29d7bdaa4477e25722d56c10ea799711d2d6e4eb1a6e5f5c48b474613fcb0825e7cf282088e5e342efbdf68bf1c40641a9ea202be057909013dfaff486d39b9fc8f1cc6a29c5af9d6d17c37c88e079ddcb40e4303f0cbf6cb92145f354ac3d53a5ba70d3c410fb96f0e744a10d14c1f282d55aa4776590b7e3b051bac9dedaa11316c14a9005fa8201c585d883794a17cadb28855992d317f4c95789cc71e14cd7ead4210d22e86b84493d407389706e1cd71448e8bda0a46bd543e71b17ae7c4dc564c7279e92f032206cbb407e56b63b5fb48138131d05df8ef0262a87b274efbb1abf55ceb51bc2d97bbabcb780ae165ac9af3cbd748f2033948a6ca5d4de2e31a642836a2fc40cfa0e4ee94a41769cd1452e9c07ea2f06670b4d691302eead5d5c8f1536d166da649722f50cf56eee3910642d13ae5575b6f130dcc28f4e2f6e01f762afd3c9f15d0b2710cff4f2b6080db9cd1e538934725d1122673830cde6f96740b3c26928ea249dd4f8d19f6545a9db02448cf0d6a15d59c87550e6b092eeefa4472c5d545d548e35a93fcb1bc80bf740d2c779a451fbe83fc229965149778845dcd7f018d2ff780c3c8971d1f7e9d225f0c3a10aa091831de1c949b761fe55655151753a5366e052eccda7b5639906545e1119b6922bfb5ebe6d90e4797706437c9fb5dfc9b", @generic="9fff70f2ae59d84ef680a4cdcf17e130890bbe0f93dbb2c8cedb05e37b9ec1ed89ba4dd5241f17dc8c04de22046561d08cf8b43a3bdfa28585d49dbf1cc5dba7f5c5ec7c32257437fa76c4ce952ed6b289a0f950c377989b54429fcc917f7829484ae17b629c228081698e08c73ca1536aa2eda73b25231bf65865e9083478ab9791b17b2d203d5a0001b1dad5b5458ed2eb95e9d7632b0f5877cbedd2d4f2ddeb6fac0d0becf4744d7402cf441eb61d138f8cce83235bcf070349", @typed={0x24, 0x6, @str='md5sum*em1\xc4^,trusted\xc1&R[keyring\x00'}, @typed={0x14, 0x4c, @ipv6=@mcast1}, @typed={0x8, 0x64, @fd=r6}, @generic="437c91a89ece6d51537fb5b43f7d483689130ffad9d5161e8f06b85d8390768ce83fbb9600b7f0f1d87145bcdc4b26a7569384d5d8fa52b80c741ce2ebab67f8b802db0cee2fd67172d90bbac537ec003a91cd9afefb20e31454f6c2d5ba4fbe170488b112b389bca448468b675cc048682ade301a05886e538747d56b830ce14cd883747cb32e45917c963b14493e3cfd9ee315a12bc05895ff5e5de85e737dd30da03a21ec43463871a2e88eb90bc697f739fc45cb6685e4ce88", @typed={0xc, 0x2d, @u64=0x1}, @typed={0x8, 0x47, @u32=0x2}, @generic="8725624178178f6408921377fd81becc6c7a95cb73d2f1e763f627514126f8defd8c3ad0cd98cd62d2a9"]}]}, 0x1210}, 0x1, 0x0, 0x0, 0x4}, 0x400a055)
r7 = geteuid()
r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000400)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}]}})
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r9)
chown(&(0x7f0000000000)='./file0\x00', r7, r9)
mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x800000, &(0x7f0000000500)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x22f}}, {@blksize={'blksize', 0x3d, 0x1000}}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x1000}}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@euid_lt={'euid<', r7}}, {@hash='hash'}, {@smackfsdef={'smackfsdef', 0x3d, 'fuse\x00'}}]}})
sendfile(r0, r1, 0x0, 0x8000fffffffe)

[  402.684033] binder: 16659:16664 transaction failed 29201/-22, size 984-24 line 3475
[  402.701500] binder_alloc: 16680: binder_alloc_buf size -3797786271152078704 failed, no address space
[  402.701508] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  402.701527] binder: 16680:16691 transaction failed 29201/-28, size 120-24 line 3284
[  402.701987] binder: undelivered TRANSACTION_ERROR: 29201
[  402.840507] binder: undelivered TRANSACTION_ERROR: 29201
[  402.857095] binder: 16659:16701 not enough space to store 0 fds in buffer
[  402.864716] binder: 16659:16701 transaction failed 29201/-22, size 984-24 line 3475
[  402.874106] binder: undelivered TRANSACTION_ERROR: 29201
03:16:46 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:46 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000140)=0x8)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000100)={0x67d6, 0x7, 0x6, 0xe586, 0x90ce})
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r5 = getpid()
fcntl$lock(r4, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r5})
r6 = syz_open_procfs(r5, &(0x7f0000000400)='sched\x00')
r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480)='TIPCv2\x00')
sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f0000000880)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000840)={&(0x7f00000004c0)={0x37c, r7, 0x10, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xe8, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6erspan0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x157, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}}, {0x14, 0x2, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @remote}}, {0x14, 0x2, @in={0x2, 0x4e20, @remote}}}}]}, @TIPC_NLA_BEARER={0x13c, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6erspan0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x80}}}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x19e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa93}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x9, @mcast2}}}}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xae}]}, @TIPC_NLA_SOCK={0x38, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x640a}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x400}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0xac, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xdc}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @empty}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @local}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x20, @loopback, 0x5}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9e}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x34a}]}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}]}]}, 0x37c}, 0x1, 0x0, 0x0, 0x100}, 0x40)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000100000000000000000000000000000000000200006a0000000000000018000000000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:46 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000100)={r1, 0x0, 0xb7ee9b4, 0x800, 0x7ff})

03:16:46 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r1)
r2 = geteuid()
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="e6643d", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0])
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
mount$fuseblk(0x0, 0x0, &(0x7f0000000240)='fuseblk\x00', 0x100800, &(0x7f0000000740)=ANY=[@ANYBLOB='&d=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f5b6d6f64653d30303030303030303030303030303030303134303030302c757365725f69643d089f911c9ea018f5364011da07a492c22bfe884e5663258a8c6d6ad517d4ff460d72a2f8ec381ccd7f7c34f2e8289724f7a79d42b7c39cc1e94df4690f045347ea20188ac769ba305402e086a3851cd1b808c62ece5cab6a32af5bce3105e6c187d7fb7da032a09293ccf895a6f5f577f1957c8f92d2f28f8fd0cbebc63f7dac6427b4ee299b01a9385b6d9d767502bb4567b7279101b0082c59b4200cdb58aa1fdef3dfce75e3f4a615b41bf88860fdc6fe756b3b2029768c7cd52850395d2afecd26b605491a7b0f224a24cb690de7a8f4ac3890c38885f8f6b4ef205b3e482e7775be3949153bb91a447d00324e3b64c8ca154d0c8e723afe3d4c731f96a666afb5d1eabd14c9d2206cdc30b0", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB="2c626c6b73697a653d3078303030307031303030303030303230302c6d61736b3d5e4d41595f455845432c00944a0924b7da455e135e605032a11ee54053639f9e78e62ef27f032008d4d8321e51ca5fd197bc298f9ffe1e18326ff1b06027af7f63c29c7d9974bf4ee58500a5dfaa5e8ac12f08201f494af9144c555805132738c9b3928fcc3e00"])
chown(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, r4)
chown(&(0x7f0000000000)='./file0\x00', r2, r4)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r8, 0x0, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r9, 0x0, 0x0)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r9, 0x400454ce, r11)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r12=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r12)
r13 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r13, 0x0, 0x0)
r14 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r15=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r13, 0x400454ce, r15)
getgroups(0x5, &(0x7f0000000040)=[r7, 0xee00, <r16=>r12, 0xee00, r15])
keyctl$chown(0x4, r1, r2, r16)
r17 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r18 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r18, @ANYBLOB="4f726f6f746d6f64653d30303030303030303230303021303030303034303030302c757365725f69643d74be60a0af04f1b49daf25dc79504fe34a3fb1c23bba8e8a32cdbf4e5869a9720d5d3cd3c369f303702271fc96dab8285685238eb2afbcd92be536f46094dc5d6b621bfef48ebfcab3ccc865fccea8e9d177a9cd39c6479095d0bd962c11462c4fdb94899f17477db7ffd02c0786853571992a70", @ANYRESDEC=0x0, @ANYBLOB=',gvoup_id=', @ANYRESDEC=0x0])
sendfile(r18, r17, 0x0, 0x8000fffffffe)

03:16:46 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0))
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400040000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/se\x00i-\xcdx/ene\x00', 0x200000, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = syz_genetlink_get_family_id$net_dm(&(0x7f00000002c0)='NET_DM\x00')
sendmsg$NET_DM_CMD_START(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800102}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, r4, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4051}, 0x4008041)
read$char_usb(r2, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r6)
bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e24, @broadcast}, 0x10)

03:16:46 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

[  405.584726] binder: 16708:16711 not enough space to store 0 fds in buffer
[  405.587717] binder: 16707:16715 ioctl 1 20000140 returned -22
[  405.593249] binder: BINDER_SET_CONTEXT_MGR already set
03:16:46 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f00000003c0)={0x2f, @loopback, 0x4e22, 0x2, 'wlc\x00', 0x20, 0xffff, 0x43}, 0x2c)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
rt_sigaction(0x20, &(0x7f00000001c0)={&(0x7f0000000100)="c4a17172d0eb40af0f99981e000000dee54e0f38f94e59f26632710df0450fb36ee2c4e12df993b90effffc4210d72f430660f63b41b06000000", {0x37}, 0x10000000, &(0x7f0000000140)="f3440fa7c8c4e1b016f48f4878c32fff42e6f9c4c218f30ec4037904d500460f11e0dbe1fcf3ad"}, &(0x7f00000002c0)={&(0x7f0000000200)="66460f615cf709660f75e5c403f50d8931750000fef3f045873a3ef20f115a8ac4c2c54082cac60000f77495360f38f19e01000000670fe19e470000008f2a48120891ca0000", {}, 0x0, &(0x7f0000000280)="2edab60e000000c4e2e50689b8b84f07f22ef045809e001000020fd39208000000c4c178ae58ce66440f3adf37d8c4c2e9df2a420f0f6cfc0097420f1c0bdbcd"}, 0x8, &(0x7f0000000300))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:46 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000040)=0x8b, 0x4)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB="2c726f6f746d6f64653d3030300000000000e8ff073030303030303034303030302c757365725f69643d94eadc4babaaecd866d896cd128a20c240ff1ff846712247b420d811dd355ae0fb224e5efee19139b13fc01f6f8f68c7150d1f268ecc03a16ab040040b46d29a4d233d13d113277bbbbbf9b6b43b72c817a415ff73e47872ae5e663ec18300000000000000", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r5, r1, 0x0, 0x8000fffffffe)

[  405.593257] binder: 16705:16712 ioctl 40046207 0 returned -16
03:16:46 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

03:16:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r5 = openat$cgroup_ro(r2, &(0x7f0000000140)='io.stat\x00', 0x0, 0x0)
ioctl$TCGETS2(r5, 0x802c542a, &(0x7f00000001c0))
r6 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff)
setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000100)=@req3={0x4, 0x40, 0x0, 0x1ff, 0x63ed, 0x6, 0x9}, 0x1c)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  405.593532] binder: 16705:16712 not enough space to store 0 fds in buffer
[  405.593557] binder: 16705:16712 transaction failed 29201/-22, size 120-24 line 3475
03:16:46 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$PPPIOCSMRRU(r2, 0x4004743b, &(0x7f0000000400)=0x1000)
r5 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r6 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r5, r6)
r7 = dup(r6)
r8 = getpgrp(0x0)
ioctl$TIOCSPGRP(r7, 0x5410, &(0x7f00000003c0)=r8)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r9 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r9, 0x4024700a, 0x0)
preadv(r9, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000280)={0xc4, 0x0, &(0x7f00000002c0)=[@dead_binder_done, @exit_looper, @register_looper, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/53, 0x35, 0x1, 0x40}, @fda={0x66646185, 0x4, 0x1, 0x13}, @fda={0x66646185, 0x2, 0x1, 0x30}}, &(0x7f0000000040)={0x0, 0x28, 0x48}}}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x14}, @fda={0x66646185, 0xa, 0x2, 0x3b}, @flat=@handle={0x73682a85, 0x100a, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}, 0x40}, @acquire_done={0x40106309, 0x2}, @increfs={0x40046304, 0x1}, @exit_looper], 0x0, 0x0, 0x0})

[  405.607316] binder: undelivered TRANSACTION_ERROR: 29201
[  405.624416] binder_alloc: 16707: binder_alloc_buf size 6755399441055744 failed, no address space
[  405.624423] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  405.624439] binder: 16707:16715 transaction failed 29201/-28, size 6755399441055744-0 line 3284
[  405.624723] binder: undelivered TRANSACTION_ERROR: 29201
[  405.625195] binder: BINDER_SET_CONTEXT_MGR already set
[  405.625202] binder: 16705:16720 ioctl 40046207 0 returned -16
[  405.626156] binder: 16705:16720 not enough space to store 0 fds in buffer
[  405.626182] binder: 16705:16720 transaction failed 29201/-22, size 120-24 line 3475
[  405.628581] binder: 16707:16723 ioctl 1 20000140 returned -22
[  405.638826] binder: undelivered TRANSACTION_ERROR: 29201
[  405.688454] binder: 16731:16733 not enough space to store 0 fds in buffer
[  405.688481] binder: 16731:16733 transaction failed 29201/-22, size 120-24 line 3475
[  405.688651] binder: undelivered TRANSACTION_ERROR: 29201
[  405.700439] binder: BINDER_SET_CONTEXT_MGR already set
[  405.700447] binder: 16731:16737 ioctl 40046207 0 returned -16
[  405.726983] binder: 16738:16743 not enough space to store 0 fds in buffer
[  405.727007] binder: 16738:16743 transaction failed 29201/-22, size 120-24 line 3475
[  405.727335] binder: undelivered TRANSACTION_ERROR: 29201
[  405.739918] binder: 16738:16743 not enough space to store 0 fds in buffer
[  405.739948] binder: 16738:16743 transaction failed 29201/-22, size 120-24 line 3475
[  405.740117] binder: undelivered TRANSACTION_ERROR: 29201
[  405.931917] binder: 16708:16711 transaction failed 29201/-22, size 120-24 line 3475
[  405.941586] binder: undelivered TRANSACTION_ERROR: 29201
[  405.947192] binder: BINDER_SET_CONTEXT_MGR already set
[  405.947200] binder: 16708:16729 ioctl 40046207 0 returned -16
03:16:49 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:49 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030e1f5e6f4165a5f289c8b00d33030303430", @ANYRESDEC=0x0, @ANYBLOB="0ce5bff8ff324cffff00", @ANYRESDEC=0x0])
fsetxattr$security_smack_transmute(r1, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x1)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe)

03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = getegid()
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
readv(r3, &(0x7f00000001c0)=[{&(0x7f00000003c0)=""/202, 0xca}, {&(0x7f0000000280)=""/178, 0xb2}, {&(0x7f0000000140)=""/15, 0xf}], 0x3)
read$char_usb(r2, 0x0, 0x0)
write$P9_RAUTH(r3, &(0x7f0000000200)={0x14, 0x67, 0x2, {0x25, 0x1, 0x1}}, 0x14)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
pipe(&(0x7f00000004c0)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
vmsplice(r7, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1)
pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, <r8=>0xffffffffffffffff}, 0x0)
splice(r6, 0x0, r8, 0x0, 0x6f, 0x0)
openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/policy\x00', 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000500)=0xfffffffffffffdb9)
dup2(r2, r4)
ioctl$TUNSETGROUP(r2, 0x400454ce, r10)
setgroups(0x3, &(0x7f0000000100)=[r1, r10, 0xee00])
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r11 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0xffffffffffffff24, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x8000001, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:49 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000000010000000"], 0x0, 0x0, 0x0})

03:16:49 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a747000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000280000000000000000000000000000006046daf2a1eb536b6f28ddc0d03f732d14c9b46436407f3ea45b5106c7545ef14d107af59100092eed7c3f1802b0711f1665d7ac0620c7b9605af97b593b876546513c51572d0c33056a9a66924e5bde4b8791870ed8d71cd9676caf142d6488826b8987fb0a469e47bbfefc38dfb787c59c4d3d2f8a35cbd04b09ec8bc0744857f60145d7187e08c2ff3eb2d0c49466eca6170a1b0d131f1aadc8a3459498259ad49eada42051f0c7ce6d242070d2bed199935d212520ca7ef50d3983c649b5590ca006bd4f3d8cae77adb66e6ac54717ef878cace63f38de8af581a7b360a4e97a472245c7547900b3f37d39fd5c9e2debb62f0cfce97e2b237b11d8f9d216e197"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:49 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04634840000000646a00000000000000000000000000000000000000000000001a00000078000000000000001800000000000004", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

[  408.610038] binder_alloc: 16754: binder_alloc_buf size 68719476880 failed, no address space
03:16:49 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
utimensat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={{0x77359400}}, 0x100)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_SET(r3, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40100030}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x134, r4, 0x6bf73515346ab310, 0x70bd28, 0x25dfdbfe, {}, [{{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x1df}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x2}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x1}}]}, 0x134}, 0x1, 0x0, 0x0, 0x81}, 0x24000010)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1f969ebd2e9467d860e6f6e8b141f259cfa7707c48e8f04ddbaf318d2b8dc5180cabe25a31269e5a0db6ab2d6599c985a6266f74299bb6e9e19b8cde929d1086c1b1abfd68b4d2a7", @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000\a\x0000040000,use\x00\x00id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x2)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x8900, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}, 0x2020}], 0x0, 0x0, 0x0})

[  408.619564] binder_alloc: 16756: binder_alloc_buf size -104 failed, no address space
03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

03:16:49 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$UI_SET_RELBIT(r1, 0x40045566, 0x7)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
fcntl$F_SET_FILE_RW_HINT(r4, 0x40e, &(0x7f00000015c0)=0x4)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r5, 0x0, 0x0)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r7=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r7)
getsockopt$EBT_SO_GET_INIT_ENTRIES(r5, 0x0, 0x83, &(0x7f0000001500)={'filter\x00', 0x0, 0x3, 0x77, [], 0x100002b4, &(0x7f0000001600)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000001440)=""/119}, &(0x7f00000016c0)=0x78)
mkdir(&(0x7f0000000100)='./file0\x00', 0x12)
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
preadv(r9, &(0x7f00000013c0)=[{&(0x7f0000000140)=""/51, 0x33}, {&(0x7f00000001c0)=""/97, 0x61}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f0000000240)=""/205, 0xcd}], 0x4, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000077b99c000000000028000000000000005000000000"], @ANYBLOB="ff00"], 0x0, 0x0, 0x0})

[  408.619589] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  408.619605] binder: 16756:16758 transaction failed 29201/-28, size 112--220 line 3284
[  408.620274] binder: undelivered TRANSACTION_ERROR: 29201
[  408.625792] binder: 16757:16763 got transaction with invalid offset (40, min 40 max 120) or object.
[  408.625816] binder: 16757:16763 transaction failed 29201/-22, size 120-24 line 3379
[  408.625951] binder: undelivered TRANSACTION_ERROR: 29201
[  408.629640] binder: 16757:16767 got transaction with invalid offset (40, min 40 max 120) or object.
03:16:49 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000100)={0x100, 0x3, 0x7ff, 0x1})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:49 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000040)='./file0\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r5, 0x4024700a, 0x0)
r6 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r6, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r7 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r6, r7)
ioctl$EXT4_IOC_MIGRATE(r7, 0x6609)
preadv(r5, &(0x7f00000017c0), 0x1fe, 0x500)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r8, 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r10)
r11 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r11, 0x0, 0x0)
r12 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r13=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r11, 0x400454ce, r13)
r14 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r14, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r15 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r14, r15)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYPTR64=&(0x7f0000000740)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESOCT=r0, @ANYPTR, @ANYRESHEX=r2, @ANYPTR64, @ANYRESDEC=r5, @ANYRES32=r3, @ANYRES32=r1], @ANYRESDEC=r2, @ANYRESDEC=r8, @ANYBLOB="12e9dc7397741a821220d048e97513d405546e836f9978fdc87d9ca3d63cca1e76f21329a7940af4d0ba9cb6d6c051a67ec62882378b8538e5f525a9ce67e0142ed2860314d627c723b42d4a2185f17796d872b2430de020b2487d28bbe497697005978b348eeb262ec786fe7c455fe0469d0ad94a8b49c6091724be092efdb8a1044bae37dd6b8b1618ded63eb5fc2baee25417d0d2bca308cbe9d73d75879e050b31c68092f77d2737fe70db352d4852b872ee5cc93b9f702d81d13cdc38de5085cdf2746242c17a9d1136456c2872d9a3c13b1eb2d8f395448d11381cfff5c117f7a976e4b3beb0", @ANYRESDEC=r0, @ANYRESDEC=r11, @ANYRESOCT=r1, @ANYPTR=&(0x7f0000000080)=ANY=[@ANYPTR, @ANYRES16=r2, @ANYRES16, @ANYRES32=r0, @ANYRESDEC=0x0], @ANYRES32=r14]], @ANYRESDEC=0x0, @ANYBLOB="2c6e0d3c67705f69623d00786982fe8dee608af3f8f1c0628e505157c0e7917834dcaf36dd476167597d97d6c036ac20830df9221e1c1e6e5cd8865522ba049750b17f065766a200e6c7e2caff68df5f850261faf75f397726736d5616e0c6e37229a47ddca2fc81b36f7c77ff2fc226844f516ef088a621625a79eccaaa0e11ab717978994bbcc626531d29a609000000000000002f9ba8d11f28be0924b6f7e34d60c5a0aed976ee1123989d336ac7320000d30000", @ANYRES16])
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe)

[  408.629667] binder: 16757:16767 transaction failed 29201/-22, size 120-24 line 3379
[  408.630208] binder: undelivered TRANSACTION_ERROR: 29201
[  408.697395] binder: 16771:16778 unknown command 1078485764
[  408.697403] binder: 16771:16778 ioctl c0306201 20000180 returned -22
[  408.708354] binder: 16771:16781 unknown command 1078485764
[  408.708364] binder: 16771:16781 ioctl c0306201 20000180 returned -22
[  408.802521] binder_alloc: 16790: binder_alloc_buf size 7380948093865623952 failed, no address space
[  408.802528] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  408.802544] binder: 16790:16794 transaction failed 29201/-28, size 120-24 line 3284
[  408.802913] binder: undelivered TRANSACTION_ERROR: 29201
[  408.909478] binder: 16799:16802 not enough space to store 0 fds in buffer
[  408.909509] binder: 16799:16802 transaction failed 29201/-22, size 120-24 line 3475
[  408.909825] binder: undelivered TRANSACTION_ERROR: 29201
[  408.916528] binder: 16799:16806 not enough space to store 0 fds in buffer
[  408.916551] binder: 16799:16806 transaction failed 29201/-22, size 120-24 line 3475
[  408.916846] binder: undelivered TRANSACTION_ERROR: 29201
[  408.982980] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000028000000000000025000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:49 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x1e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a646600000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00`\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x0)

03:16:49 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746df288e40030303030303030303030303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f0000000340)=""/194)

03:16:49 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfffffffffffffffe)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a74700000000000000000000005000000000000000000000023000000000000000000004b2d70f801000000852a7470000000000700000000000000000000000000000000000000000000000000000000f5ffff8461646600000000000000000000000001000000c6559aa15146a38af974812963bb5d1a25466749a7cc8a0d2d9d0e4d69d16374f452685d321736969d2ec7a17df52abb54370c99408fcf4ea6e092cb9bcdbdff4824b864274614e902ee37a1073ecdc959cdd6cb492de654e11a26e36558b5666439f8db7a4b58ac5bcb95354452d404ff8c23a7863168c47b727a99906cdb3e7b779ff3c4e15e"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000100)={0x6}, 0xc)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00')
sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f00000004c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x90, r4, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xf4fe}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x9ba5b7e9034166f9}, 0x40040)

[  408.992533] binder: 16754:16759 transaction failed 29201/-28, size 120-24 line 3284
[  409.002672] binder: undelivered TRANSACTION_ERROR: 29201
[  409.006500] binder: BINDER_SET_CONTEXT_MGR already set
03:16:49 executing program 3:
r0 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x0)
fremovexattr(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="62747266732e2f6465762f696e7075742f6d696365001238261a2f727ba5017f847885f8836e8498efd34c8443b36f6131ff4c958a2a2ffc9ff24a376f3cb92ec8c0986add69e65e40040bea15979a904e9f766fc50c10a1bc890866c300338dd761e97dcf18f407be0838fc7d3a4772c7f55be49a41"])
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = inotify_init()
fsetxattr$security_selinux(r3, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:auditd_unit_file_t:s0\x00', 0x28, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x4}, @fda={0x66646185, 0x9, 0x0, 0x14}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x40}], 0x0, 0x0, 0x0})

03:16:49 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x0)

[  409.006508] binder: 16754:16813 ioctl 40046207 0 returned -16
[  409.006718] binder_alloc: 16754: binder_alloc_buf, no vma
03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000028010000000000005000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  409.006734] binder: 16754:16813 transaction failed 29189/-3, size 120-24 line 3284
[  409.042396] binder: 16817:16820 got transaction with fd, 5, but target does not allow fds
[  409.042421] binder: 16817:16820 transaction failed 29201/-1, size 120-24 line 3427
[  409.055084] binder: BINDER_SET_CONTEXT_MGR already set
[  409.055094] binder: 16817:16824 ioctl 40046207 0 returned -16
[  409.071147] binder: BINDER_SET_CONTEXT_MGR already set
[  409.071155] binder: 16823:16826 ioctl 40046207 0 returned -16
[  409.078837] binder: 16816:16828 got transaction with invalid offset (144115188075855912, min 40 max 120) or object.
03:16:49 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:49 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x7f, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$TCSBRK(r3, 0x5409, 0x400)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:49 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x11b881)
socket$inet6_udplite(0xa, 0x2, 0x88)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000))
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, 0x2}], 0x1e4, 0x0, 0x0})

03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
write$nbd(r1, &(0x7f00000001c0)={0x67446698, 0x1, 0x0, 0x4, 0x4, "3cd98caa58467404da103b2ca1dda22675f451a8bcfa3329bb062a3814e50c71e4582a260bed14e9586b24de7d9572642404bcc9da1412d79840b5d5bb2469a8512e500c1cf352a21e599dd1f9361ec7eeade22543c8238f43a10990ae40d56cf1d12ab25e6c1f4a9a250172fd66166563afa77e2c5b1755a4f029be5f8041c77a60212534ca614b3922a49224f7666635ffac9e16f21ff90f7f7eac50663984ad053a8687d9292f7a391df05e7258388a7d24134f4bdfbc06927de39759820116e7930c1d45759374463e"}, 0xdb)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  409.078863] binder: 16816:16828 transaction failed 29201/-22, size 120-24 line 3379
[  409.079347] binder_alloc: 16754: binder_alloc_buf, no vma
[  409.079364] binder: 16823:16826 transaction failed 29189/-3, size 120-24 line 3284
[  409.092773] binder: BINDER_SET_CONTEXT_MGR already set
[  409.092782] binder: 16816:16831 ioctl 40046207 0 returned -16
[  409.093340] binder_alloc: 16816: binder_alloc_buf, no vma
[  409.093358] binder: 16816:16831 transaction failed 29189/-3, size 120-24 line 3284
03:16:49 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)

03:16:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000001c0)="abaffe93c94ae3709406056413cd07f278773cf603a76ed4f591493d0cb6de5c9630eb288ffe0f1f5f4d27d0753f90bd0c25e4f6241c2650d34c60a3242c1245f354631ed757d35d06397ecf9a81c82607dc1ee958dadac34b206eefac5a5a6e67f36a8cd0d9421514d1e6fff8991c47ce8c251b156db9a2bda9187abff2a2477f46b1d2f36a9f1ce020805ea1d1d7b2e964191ecb8f11d1a4e98993064cac2731857eb251ac3a8364afc6c7dccb11a5289d38750b2b871f90dc0fce832d4054a63cfccdd003f5e4f1ad8c3478b318177c6a")
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:50 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
io_setup(0x8, &(0x7f00000004c0)=<r4=>0x0)
r5 = dup2(r0, 0xffffffffffffffff)
r6 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6)
io_getevents(r4, 0x4, 0x4, &(0x7f00000000c0)=[{}, {}, {}, {}], 0x0)
io_getevents(r4, 0x2, 0x7, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000100))
r7 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="00000000000000e12700000000000000500000000000000051401613b9a3fc95a7949ceede34fba44138a63b98980e66afd0164187"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
sendfile(0xffffffffffffffff, r0, &(0x7f00000002c0), 0x0)

[  409.107964] binder: BINDER_SET_CONTEXT_MGR already set
[  409.107972] binder: 16830:16835 ioctl 40046207 0 returned -16
[  409.114091] binder: BINDER_SET_CONTEXT_MGR already set
[  409.114099] binder: 16823:16837 ioctl 40046207 0 returned -16
[  409.134016] binder: BINDER_SET_CONTEXT_MGR already set
[  409.134025] binder: 16838:16842 ioctl 40046207 0 returned -16
[  409.134292] binder_alloc: 16816: binder_alloc_buf, no vma
[  409.134309] binder: 16838:16842 transaction failed 29189/-3, size 120-24 line 3284
[  409.147813] binder: BINDER_SET_CONTEXT_MGR already set
[  409.147821] binder: 16838:16843 ioctl 40046207 0 returned -16
[  409.169099] binder: BINDER_SET_CONTEXT_MGR already set
03:16:50 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000040)={'z\x00'}, &(0x7f0000000080), 0xfffffffffffffffd)
add_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140), 0x0, r1)
r2 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)="98ac5002a549bba6f450b6ec8587dec99d18c3907d91578b1a2e972c3e928c", 0x1f, r1)
keyctl$instantiate(0xc, r2, &(0x7f00000002c0)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', '/dev/full\x00', 0x20, 0x0, 0x20, [0xb, 0x63]}, 0x36, 0xffffffffffffffff)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x2040, 0x0)
setsockopt$IP_VS_SO_SET_EDITDEST(r4, 0x0, 0x489, &(0x7f00000001c0)={{0x73, @local, 0x4e21, 0x1, 'dh\x00', 0x4, 0x2, 0x1b}, {@local, 0x4e23, 0x0, 0x2, 0xffff}}, 0x44)

03:16:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001680)='/selinux/mls\x00', 0x0, 0x0)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r4 = syz_genetlink_get_family_id$tipc(0x0)
sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r4, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000001780)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x40000100}, 0xc, &(0x7f0000001740)={&(0x7f0000000140)={0x28, r4, 0x200, 0x71bd26, 0x25dfdbff, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x200c808c}, 0x880)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000f8ffffffa92be9811d638242d8969a2a4f68d64ca9d83106b3b3f99ff4481c82568d283e30f7ee1b8aa8efd9518c3162eeb3408b3fd5ba7944cf0a93a2e277301a303318029b27ce78e074ee5a867a330d63c160dea41424c9332f69105f3c424d4ab4c3d1ba3bcbf3e0faea26ba7b5c3b8148ba5112bd09015c84a9cb5f93cc3fc7015e4a7f80cc5cc434020692b8cb6fbfbcf76207528f4b0ea39c08e626853ea6fa93b67c30a29a43abe6e3"], 0x0, 0x0, 0x0})

[  409.169107] binder: 16830:16844 ioctl 40046207 0 returned -16
[  409.239963] binder: BINDER_SET_CONTEXT_MGR already set
[  409.239971] binder: 16848:16851 ioctl 40046207 0 returned -16
[  409.240361] binder_alloc: 16816: binder_alloc_buf, no vma
[  409.240377] binder: 16848:16851 transaction failed 29189/-3, size 112-24 line 3284
[  409.255607] binder: BINDER_SET_CONTEXT_MGR already set
[  409.255615] binder: 16848:16852 ioctl 40046207 0 returned -16
[  409.255945] binder: BINDER_SET_CONTEXT_MGR already set
[  409.255952] binder: 16849:16854 ioctl 40046207 0 returned -16
[  409.260138] binder: 16849:16854 BC_INCREFS_DONE u0000000000000002 no match
[  409.260144] binder: 16849:16854 unknown command 0
[  409.260151] binder: 16849:16854 ioctl c0306201 20000180 returned -22
03:16:50 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r3 = getpid()
fcntl$lock(r2, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r3})
syz_open_procfs(r3, &(0x7f0000000100)='net/dev_snmp6\x00')
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  409.271403] binder: BINDER_SET_CONTEXT_MGR already set
[  409.271412] binder: 16849:16857 ioctl 40046207 0 returned -16
[  409.294537] binder: 16849:16857 BC_INCREFS_DONE u0000000000000002 no match
[  409.294542] binder: 16849:16857 unknown command 0
[  409.294549] binder: 16849:16857 ioctl c0306201 20000180 returned -22
[  409.324800] binder: BINDER_SET_CONTEXT_MGR already set
[  409.324809] binder: 16862:16864 ioctl 40046207 0 returned -16
[  409.334434] binder: BINDER_SET_CONTEXT_MGR already set
[  409.334443] binder: 16859:16866 ioctl 40046207 0 returned -16
[  409.334705] binder_alloc: 16816: binder_alloc_buf, no vma
[  409.334722] binder: 16859:16866 transaction failed 29189/-3, size 120-24 line 3284
[  409.339363] binder: BINDER_SET_CONTEXT_MGR already set
[  409.339371] binder: 16862:16867 ioctl 40046207 0 returned -16
[  409.376527] binder: BINDER_SET_CONTEXT_MGR already set
[  409.376535] binder: 16869:16871 ioctl 40046207 0 returned -16
[  409.437170] binder: BINDER_SET_CONTEXT_MGR already set
[  409.437178] binder: 16873:16876 ioctl 40046207 0 returned -16
[  409.456966] binder: BINDER_SET_CONTEXT_MGR already set
[  409.456975] binder: 16874:16877 ioctl 40046207 0 returned -16
[  409.457220] binder_alloc: 16817: binder_alloc_buf, no vma
[  409.457272] binder: 16874:16877 transaction failed 29189/-3, size 120-24 line 3284
[  409.465467] binder: BINDER_SET_CONTEXT_MGR already set
[  409.465476] binder: 16874:16881 ioctl 40046207 0 returned -16
[  409.465573] binder_alloc: 16816: binder_alloc_buf, no vma
[  409.465589] binder: 16873:16876 transaction failed 29189/-3, size 120-24 line 3284
[  409.465673] binder_alloc: 16817: binder_alloc_buf, no vma
[  409.465689] binder: 16874:16881 transaction failed 29189/-3, size 120-24 line 3284
[  409.468997] binder: BINDER_SET_CONTEXT_MGR already set
[  409.469005] binder: 16873:16883 ioctl 40046207 0 returned -16
[  409.534913] binder: BINDER_SET_CONTEXT_MGR already set
[  409.534920] binder: 16886:16889 ioctl 40046207 0 returned -16
[  409.535643] binder_alloc: 16817: binder_alloc_buf, no vma
[  409.535660] binder: 16886:16889 transaction failed 29189/-3, size 120-24 line 3284
[  409.536415] binder: BINDER_SET_CONTEXT_MGR already set
[  409.536423] binder: 16886:16890 ioctl 40046207 0 returned -16
[  409.537179] binder_alloc: 16817: binder_alloc_buf, no vma
[  409.537195] binder: 16886:16890 transaction failed 29189/-3, size 120-24 line 3284
[  409.721033] binder: undelivered TRANSACTION_ERROR: 29189
[  409.726615] binder: undelivered TRANSACTION_ERROR: 29189
[  409.732213] binder: undelivered TRANSACTION_ERROR: 29189
[  409.737885] binder: undelivered TRANSACTION_ERROR: 29189
[  409.743453] binder: undelivered TRANSACTION_ERROR: 29189
[  409.749254] binder: undelivered TRANSACTION_ERROR: 29189
[  409.755054] binder: undelivered TRANSACTION_ERROR: 29189
[  409.760983] binder: undelivered TRANSACTION_ERROR: 29189
[  409.766595] binder: undelivered TRANSACTION_ERROR: 29189
03:16:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:50 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:50 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = gettid()
ptrace(0x4208, r1)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  409.772150] binder: undelivered TRANSACTION_ERROR: 29189
[  409.777756] binder: undelivered TRANSACTION_ERROR: 29201
[  409.783395] binder: undelivered TRANSACTION_ERROR: 29201
[  409.789036] binder: undelivered TRANSACTION_ERROR: 29189
[  409.809349] binder: 16892:16894 not enough space to store 0 fds in buffer
03:16:50 executing program 2:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x0)

03:16:50 executing program 0:
pipe2(&(0x7f0000000040)={<r0=>0xffffffffffffffff}, 0xc000)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'hsr0\x00', 0x1000})
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='hd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
open(&(0x7f0000000140)='./bus\x00', 0x80200, 0x6)
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:50 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x806)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES16=r0, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRESDEC], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="60b2977e3d8d2e786b5db1f49ce3acc70cba2205b8aff7ebe5bc313acdeb76e68577442f724809fe8a1840ee36465469102015b05b521094acb9bd65a8d208bf0309b35fac2b8619e25aff960d28a03e2e40429797bb7cd6f3837b1b1dc1528bb71db0f5479df570612b0548a7371dd7303d24a22c81330e1920e418403ea5551b9d72f52b786e9bb47aed76085d6934f07259d1bab8d73dbdeacac49c6bce8e01d86f554518abc0b23557a6b699e576129180f47c3ca43d"], 0x4de, 0x0, 0x0})

[  409.816921] binder: 16892:16894 transaction failed 29201/-22, size 120-24 line 3475
[  409.828608] binder: undelivered TRANSACTION_ERROR: 29201
[  409.836362] binder: 16892:16899 not enough space to store 0 fds in buffer
[  409.844030] binder: 16892:16899 transaction failed 29201/-22, size 120-24 line 3475
[  409.849272] binder: 16895:16900 not enough space to store 0 fds in buffer
03:16:50 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0))
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400040000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/se\x00i-\xcdx/ene\x00', 0x200000, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = syz_genetlink_get_family_id$net_dm(&(0x7f00000002c0)='NET_DM\x00')
sendmsg$NET_DM_CMD_START(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800102}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, r4, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4051}, 0x4008041)
read$char_usb(r2, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r6)
bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e24, @broadcast}, 0x10)

03:16:50 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000420}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0xb8, r4, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'lapb0\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x101}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1e}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080)
r5 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r6, r5, 0x0, 0x8000fffffffe)

[  409.849294] binder: 16895:16900 transaction failed 29201/-22, size 120-24 line 3475
[  409.849432] binder: undelivered TRANSACTION_ERROR: 29201
[  409.894041] binder: undelivered TRANSACTION_ERROR: 29201
[  409.937600] binder: 16910:16914 unknown command 54525955
[  409.954614] binder: BINDER_SET_CONTEXT_MGR already set
[  409.954622] binder: 16913:16917 ioctl 40046207 0 returned -16
[  409.955886] binder: 16913:16917 not enough space to store 0 fds in buffer
[  409.955914] binder: 16913:16917 transaction failed 29201/-22, size 120-24 line 3475
[  409.976835] binder: undelivered TRANSACTION_ERROR: 29201
[  410.002627] binder: 16910:16914 ioctl c0306201 20000180 returned -22
[  410.017052] binder: 16910:16922 unknown command 54525955
[  410.022836] binder: 16910:16922 ioctl c0306201 20000180 returned -22
03:16:50 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x7, 0x4, 0x638, 0x218, 0x338, 0x338, 0x550, 0x550, 0x550, 0x4, &(0x7f0000000100), {[{{@uncond, 0xf0, 0x218}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x9, 'system_u:object_r:semanage_exec_t:s0\x00'}}}, {{@uncond, 0xf0, 0x120}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x200, 0x1, 0x8, 0xfa88f0cc3895b658}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x10}, @broadcast, 0xffffffff, 0xffffff00, @mac=@broadcast, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}, @mac=@broadcast, {[0x0, 0x0, 0x0, 0x0, 0xff]}, 0x1, 0x9, 0x9, 0x9, 0x4, 0x5, 'yam0\x00', 'caif0\x00', {}, {0x1fe}, 0x0, 0x20}, 0xf0, 0x218}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x90d2, 'system_u:object_r:hald_keymap_exec_t:s0\x00'}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x688)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="116348400000080000000000000000000000000000000000000000000000000000000000d4bc23304722fb531800000000000000343a4d08e4f912eec85de3e2", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
read$char_usb(r4, 0x0, 0x2fb)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r8)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x8, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="056b0440030000af"], 0x70, 0x0, &(0x7f0000000400)="681daf1ee12d631dcb4f03404156b6a46c133018ebf19782cced34fc82b61766df8b4984346f1a751c46a1d37bd24f0758572cdb20f8c8f53e9d067020f43edc423ab0b483aee3cd48a5ec273c0cbe278d9fc62dc3c9478098daa12c9f8b42b00c20c632fca2f9596b5f55c096f32db2"})
r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/enforce\x00', 0x8002, 0x0)
ioctl$sock_inet6_tcp_SIOCOUTQ(r9, 0x5411, &(0x7f0000000500))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x7c, 0x0, &(0x7f0000000200)=[@acquire_done={0x40106309, 0x2}, @decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0xe3b1b95805227b54, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x100, 0x1}, @flat=@weak_handle={0x77682a85, 0x100, 0x3}, @fda={0x66646185, 0x8, 0x2, 0x25}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x1000}, @clear_death={0x400c630f, 0x3}, @enter_looper], 0x45, 0x0, &(0x7f0000000280)="8892fbccf3c70c6181abf466bf4dfc301e4a4c7a8ef93abc99d47b87e4843991acb8a75f1303216f26ae37ba36eab83766b70b8a1f282f8d7417f197b9ef6cb8b49cb9f119"})

03:16:50 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f0000000100)=[@exit_looper, @acquire_done={0x40106309, 0x2}], 0x0, 0x0, 0x0})

03:16:50 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
prctl$PR_GET_NO_NEW_PRIVS(0x27)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f00000003c0)=""/4096)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000007a000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:50 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r3, r4)
mount$fuse(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='fuse\x00', 0x2000, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030302c757365725f69643d68105abfacb6c81426ca726489d2a7600eacc97c94113058e900f7fe48cbec5738b15958c08fa9f01e70de028e937a72d1c77310263507f8bc6041efb092e47de9ef8e066fd29c2d19ab2a9b7f50b738af562ab389155e76ad38d7e73c2bca", @ANYRES32=r2, @ANYBLOB=',group_id=', @ANYRESDEC=r4])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  410.244569] binder: 16933:16934 BC_ACQUIRE_DONE u0000000000000002 no match
[  410.250209] binder: 16930:16935 got transaction to invalid handle
[  410.250218] binder: 16930:16935 transaction failed 29201/-22, size 6051468213448064212-24 line 3138
[  410.250516] binder: undelivered TRANSACTION_ERROR: 29201
[  410.258351] binder: 16932:16937 not enough space to store 0 fds in buffer
[  410.258375] binder: 16932:16937 transaction failed 29201/-22, size 120-24 line 3475
[  410.261411] binder: undelivered TRANSACTION_ERROR: 29201
[  410.262300] binder: 16932:16940 not enough space to store 0 fds in buffer
[  410.262325] binder: 16932:16940 transaction failed 29201/-22, size 120-24 line 3475
[  410.263707] binder: undelivered TRANSACTION_ERROR: 29201
[  410.273816] binder: 16936:16939 not enough space to store 0 fds in buffer
[  410.273838] binder: 16936:16939 transaction failed 29201/-22, size 120-24 line 3475
[  410.274019] binder: undelivered TRANSACTION_ERROR: 29201
[  410.342026] binder: 16933:16934 BC_ACQUIRE_DONE u0000000000000002 no match
03:16:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x8, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe, 0x50}}}], 0x0, 0x0, 0x0})
r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x4800)
ioctl$TCSBRK(r2, 0x5409, 0xa5)

03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1006)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
socket$inet6(0xa, 0x800, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$PPPIOCCONNECT(r1, 0x4004743a, &(0x7f0000000100)=0x2)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = creat(&(0x7f0000000140)='./file0\x00', 0x100)
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r3, 0x4008240b, &(0x7f00000001c0)={0x2, 0x70, 0x0, 0x1, 0x1, 0x1, 0x0, 0x8, 0x4042, 0xd, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x100, 0x0, @perf_config_ext={0x7fffffff, 0x1f}, 0x0, 0x7fffffff, 0x0, 0x9, 0x401, 0x3eff, 0x20})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840009657e1d1f9c3ded100000200000000000000000000000000000000000000001800"/52, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:53 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
pipe2(&(0x7f0000000040)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r5 = getpid()
fcntl$lock(r4, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r5})
listen(r4, 0x200)
fcntl$getownex(r4, 0x10, &(0x7f0000000140)={0x0, <r6=>0x0})
r7 = geteuid()
sendmsg$nl_netfilter(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="8403000012067c7e2cbd7000ffdbdf250a0000041c026e00f4000800222f18d3238430a679630f5c1b736cfe297b5c2a5aac696b89a096b075673cc388cf4f1043c573c07632407db0046687e7286c844e33aad8f02f158a82fe2728b11d611bd12fde2aff76695875678ba3db62604ce673be96e3b2021e8225a8faed475a35efd026c1973fc7371a3f0f7e10ea9c7e2dc60db0ad597e924be1e18e3924e887ddf262e5978294725a7a71c19b0cc50be94d3e4ae421525ad72159c198785d02e04f702b999e7d6e827274ed912d47a7b7bb7bcf4b153c9fca0b1f89604370aeb802659f033a54dfcba3913c4b40981686d66ffcd0a56c7db06e91583b909c7a3be14731b513ccdb5e81e06d86614338810888069643ee612200bfb2fca5df221fd7449f8dc7356c170f1463ba5c71487990f2575d1b23e7f58bc5500930c123fd3f", @ANYRES32=r6, @ANYBLOB="507da646b5410bc653b5a1c2b771a9f736be96be9484c83eedbad6923861aa68995d7ed142251bbe277f3e2cf4a31afdeb6d6a408bc2fb4849697251f55daba558c7cda086515e43daeb1f9e68a5514b8023a74981bc3cb0bb46c0e422f87927db0d99c639047f179e77a3cb7a1f3857ecc6b198b7eef48b6e64383b27ffede520c318d895f6e6bb51b426bed427d44b7f6fd13400a695a06a34ff77b94aa04f79e45d0bbf31a3d4678204ff4dadb70974afc7217ff09fd7cbf237fa9f6d7e2157a8621ec74db31908000f007f000001180081002b73656c661f70707031656d3173656c660000000000cc007800100035002f6465762f667573650000002653fabe090af6f78b43893ba7c364e902a07c6ab7810f09b2e5bbc9f326768f2e16dc341e5a59aa3c7c3f76546e8cde02a8cb70e08e2183efcce12f4871ce99e58c4ccf9ae3108d9b75d570cc4f7ed0715d982e504dee0e7d836a8ff7b728baebd228a821ea405d4c60b3730ec6b4e602a0b362131eac025f99617d6cd1a656da2160463b09c4afeb94180c06f39aa9a9701b402d327186e94dac29d73d6d778ab15d37fd0647540ce02814550a96b79a7fb9e02aff0000080017007f0000010c001d0066757365000000006c0042000800850076273b0008003e00", @ANYRES32=r7, @ANYBLOB="b71cabe599db33c5e33c07d20887c5116f9d9ee9ff384dc4012938a1f11c98f75d003e40fb08f93bdb13517f7c4ba89d0b7bf491dab009d98c6e6603290ac299af6d4c2f54261aaaf1fd80a444b3163e03b6278b89c6a20008008000", @ANYRES32], 0x384}, 0x1, 0x0, 0x0, 0x4010}, 0x4000000)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:53 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="364ef4ffffff0000000000000000000000be050000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:53 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:53 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BLKRAGET(r1, 0x1263, &(0x7f00000000c0))
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r3 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB], 0x0, 0x0, 0x0})

[  412.821426] binder: 16948:16953 got transaction with invalid offset (-2, min 40 max 120) or object.
[  412.828688] binder: 16950:16955 not enough space to store 2 fds in buffer
[  412.828713] binder: 16950:16955 transaction failed 29201/-22, size 112-24 line 3475
03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:53 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000040))
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  412.829067] binder: undelivered TRANSACTION_ERROR: 29201
[  412.834265] binder: 16949:16954 got transaction with invalid offset (281474975944246, min 0 max 120) or object.
03:16:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
keyctl$join(0x1, 0x0)
r4 = dup2(r2, r3)
setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r7 = getpid()
fcntl$lock(r6, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r7})
listen(r6, 0x200)
ioctl$sock_SIOCBRDELBR(r6, 0x89a1, &(0x7f0000000140)='veth1_to_bond\x00')
read$char_usb(r5, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
write$P9_RFLUSH(r4, &(0x7f00000000c0)={0x7, 0x6d, 0x1}, 0x7)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r5, 0x400454ce, r9)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x39, 0x0, &(0x7f0000000100)=ANY=[@ANYRESOCT=r9, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYRESHEX=r1], 0x0, 0x0, 0x0})

03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  412.834289] binder: 16949:16954 transaction failed 29201/-22, size 120-24 line 3379
[  412.834419] binder: undelivered TRANSACTION_ERROR: 29201
[  412.842322] binder: 16949:16959 got transaction with invalid offset (281474975944246, min 0 max 120) or object.
[  412.842345] binder: 16949:16959 transaction failed 29201/-22, size 120-24 line 3379
[  412.842559] binder: undelivered TRANSACTION_ERROR: 29201
[  412.883694] binder: 16963:16967 not enough space to store 2 fds in buffer
[  412.883719] binder: 16963:16967 transaction failed 29201/-22, size 112-24 line 3475
[  412.884067] binder: undelivered TRANSACTION_ERROR: 29201
[  412.889604] binder: 16951:16957 got transaction to invalid handle
[  412.889611] binder: 16951:16957 transaction failed 29201/-22, size 24-0 line 3138
[  412.892991] binder: undelivered TRANSACTION_ERROR: 29201
[  412.947778] binder_alloc: 16973: binder_alloc_buf, no vma
[  412.947795] binder: 16973:16978 transaction failed 29189/-3, size 120-24 line 3284
[  412.948121] binder: undelivered TRANSACTION_ERROR: 29189
[  412.948950] binder: 16974:16980 not enough space to store 2 fds in buffer
[  412.948975] binder: 16974:16980 transaction failed 29201/-22, size 112-24 line 3475
[  412.949090] binder_alloc: 16973: binder_alloc_buf, no vma
[  412.949106] binder: 16973:16978 transaction failed 29189/-3, size 120-24 line 3284
[  412.949362] binder: undelivered TRANSACTION_ERROR: 29189
[  412.949398] binder: undelivered TRANSACTION_ERROR: 29201
[  413.011524] binder: 16985:16988 unknown command 808464432
[  413.011533] binder: 16985:16988 ioctl c0306201 20000180 returned -22
[  413.152753] binder: 16948:16953 transaction failed 29201/-22, size 120-24 line 3379
[  413.162186] binder: undelivered TRANSACTION_ERROR: 29201
03:16:53 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000040)=""/107)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d303030303030000800003030382466bef7fe360ac687a10d66cb3b3034a92f0270ae3a", @ANYRESDEC=0x0, @ANYBLOB="2c6772357ceef6f593d809a719ec33b769643d", @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:53 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000001800"/52, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000001000000000000000000000000000000000000852a747000000000000000000000000004000000000000000000000000000000000000000000000085612470a8f031720851e702357c726466000000000000000000000000010000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0xa}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0xfffffffffffffd7e}}}], 0x0, 0x0, 0x0})

03:16:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/devinder#\x00', 0x0, 0x404)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x7, 0x0, 0x37}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/110, 0x0, 0x2000000000002, 0x30}}, &(0x7f0000000240)}}, @dead_binder_done, @release={0x40046306, 0x2}, @clear_death], 0x0, 0x0, 0x0})

03:16:53 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.233830] binder_alloc: 17009: binder_alloc_buf size 26388279066744 failed, no address space
[  413.243193] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  413.254719] binder: 17009:17012 transaction failed 29201/-28, size 26388279066744-0 line 3284
03:16:54 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
creat(&(0x7f0000000040)='./file0\x00', 0x0)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
rt_sigpending(&(0x7f0000000100), 0x8)

[  413.269861] binder: 17011:17016 got transaction to invalid handle
[  413.269870] binder: 17011:17016 transaction failed 29201/-22, size 112-24 line 3138
[  413.270025] binder: undelivered TRANSACTION_ERROR: 29201
[  413.327380] binder: undelivered TRANSACTION_ERROR: 29201
03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.334679] binder_alloc: 17009: binder_alloc_buf size 26388279066744 failed, no address space
03:16:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x1802)
setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f00000001c0)={0x6, &(0x7f0000000140)=[{0x7, 0x4, 0xff, 0x6}, {0x2a3, 0x8, 0x52, 0x2}, {0xbdb8, 0x1, 0x1f, 0x2}, {0x4, 0x5, 0x6, 0x3}, {0x400, 0x1, 0x98, 0xffffff81}, {0x800, 0x9d, 0x7f, 0x5}]}, 0x10)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0xfffffffffffffed2}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.372896] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  413.386243] binder: 17033:17035 not enough space to store 0 fds in buffer
03:16:54 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
write$P9_RREMOVE(r3, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030302c757365725f69643d76b9aa81d118115c44d4846e02ff3c12f374cc151095f1fd49503ee6d16363ac877d221e38026105b2c3ab52c97b53164e979cd1598bd2cfb69976a3b3751537db896d9cdcf8a5a46f0117e74b9d61153f938fb72b57954cc24896561c909324c3235e8f104c2fb5578d971bf51cdc4ffb994c0f07d2d5a36d274d97f3380113147f6483a632e9c065a763a5fad4d1f88d1a21223a888c23308b874015f553ff71fcff65b0d18a5140ebdb86b5da046406", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  413.386269] binder: 17033:17035 transaction failed 29201/-22, size 120-24 line 3475
03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.386446] binder: undelivered TRANSACTION_ERROR: 29201
[  413.453257] binder_alloc: 17041: binder_alloc_buf, no vma
[  413.453275] binder: 17041:17045 transaction failed 29189/-3, size 120-24 line 3284
[  413.453551] binder: undelivered TRANSACTION_ERROR: 29189
[  413.454699] binder: 17037:17039 transaction failed 29189/-22, size 112-24 line 3138
03:16:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
mknod$loop(&(0x7f0000000200)='./file0\x00', 0x80, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x200004)
setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000180)={{0xa, 0x4e23, 0x10000, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, {0xa, 0x4e22, 0x2, @mcast1, 0x10001}, 0x7ff, [0x4, 0x9, 0x20000000, 0xd5d2, 0xb69, 0x8, 0x4, 0xfffffffb]}, 0x5c)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x17}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
getrlimit(0xa, &(0x7f0000000100))
getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x48, &(0x7f0000000000)=""/26, &(0x7f0000000040)=0x1a)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
pause()
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x1d8, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000042d28f8383e35ee94886b21dbdf5aa0018d9bccd04ecbbb9b8aba73dabf8b302930a05fec089241201df56436b6cfc01ba2fbacc306efbf9db76ce0f15f9a4499751581cf1bd5a2e4f5a8ff9ef7254aea7e0f7dbb12ea8b5976094c437f41d18a90f3b9a6c1a7de36c000000cfcafc3e5e711a4eb07ce6737a62d9bf16aa04bd1d5f2b8558d73710121c23a442bd849a61df7950bea0f4224d1ba1e2df05b823cd7252df13c3a13a0ae17810fbc487800000004f0b49b6b721d1778d1200bd0d971d3cb34343f90403ea2a519fc497890c22bd866c953a5f5e8a29f97d08e378f1924028cf7340fa80e5e19b5b7ee352b8a2fe8ca43745ea88e2de8f1d2b00a4b811f5f2a1d023477120ed2e5108f37037048f2464a81f34a6e798ed5b97fde7e31af18e7753926c1cec09e2a06c6966f1c77ad5f433e4dde5feedaf307b3b9e69c88a835a0e011150982d3367c0ae314867f4aaa80d2e608077db394428a47f57972b913e9dd629d7439ae3461d27800320685ea42fd1194e47e681d14ac4620d620352084d5a4499c3f1d811", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000140)={0x1})

03:16:54 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xfe8e, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0xa00, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0xe8, 0x1, 0xb}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x4000000)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.454914] binder: undelivered TRANSACTION_ERROR: 29189
[  413.534650] binder: 17052:17055 transaction failed 29189/-22, size 112-24 line 3138
[  413.534839] binder: undelivered TRANSACTION_ERROR: 29189
[  413.580338] binder: 17009:17029 transaction failed 29201/-28, size 26388279066744-0 line 3284
[  413.589374] binder: undelivered TRANSACTION_ERROR: 29201
03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="44020000", @ANYRES16=r1, @ANYBLOB="00022cbd7000fedbdf250e000000e40001002c0004001400010002004e23ffffffff00000000000000001400020002004e237f00000100000000000000001800010069623a6272696467655f736c6176655f31000000380004001400010002004e23e00000010000000000000000200002000a004e2400000001fe8800000000000000000000000005000000000000000400200001000a004e2400005000fe800000000000000000000000000021de0400001400020002004e21ffffffff00000000000000002c00020008000300020000000800030004000000080002002e04000008000300ff000000080004000900000030000200040004000400040008000200010000000400040004000400080001001f00000004000400080001007f0000002400020008000200ff010000080002000100000008000200020000000800020007000000a4000500080001006962000014000200080002000700000008000100010000000e0002000800030009000000340002000800030008000000080003000100000008000400090000000800030000000000080002000600000008000200300000004400020008000400ffffff7f08000300000300000800030003000000080001001c000000080002000400000008000400f8ffffff0800010002000000080003003f0000003800020008000200020000000400040004000400080002000500000008000100010000800400040008000200000000000800010001f8ff180006000400020004000200080001007f000000040000000000000000"], 0x244}, 0x1, 0x0, 0x0, 0x4000000}, 0x1000c004)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.674537] binder: 17062:17065 transaction failed 29189/-22, size 112-24 line 3138
[  413.686354] binder: undelivered TRANSACTION_ERROR: 29189
[  413.710125] binder_alloc: 17060: binder_alloc_buf size -380066071168828048 failed, no address space
03:16:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x3d}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.733835] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  413.763877] binder: 17060:17074 ioctl c018620c 20000140 returned -1
03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.765917] binder: 17070:17072 not enough space to store 2 fds in buffer
[  413.765939] binder: 17070:17072 transaction failed 29201/-22, size 112-24 line 3475
[  413.766392] binder: undelivered TRANSACTION_ERROR: 29201
03:16:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r2, 0xc0406619, &(0x7f0000000100)={{0x2, 0x0, @descriptor="f0cc1aaff7d07034"}})

03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.797593] binder: 17076:17077 not enough space to store 0 fds in buffer
[  413.797617] binder: 17076:17077 transaction failed 29201/-22, size 112-24 line 3475
[  413.797740] binder: undelivered TRANSACTION_ERROR: 29201
03:16:54 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  413.805208] binder: 17076:17078 not enough space to store 0 fds in buffer
[  413.805233] binder: 17076:17078 transaction failed 29201/-22, size 112-24 line 3475
03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000100)={'bridge_slave_0\x00', {0x2, 0x4e24, @remote}})

03:16:54 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  413.805782] binder: undelivered TRANSACTION_ERROR: 29201
[  413.882609] binder: 17080:17081 not enough space to store 2 fds in buffer
[  413.882633] binder: 17080:17081 transaction failed 29201/-22, size 112-24 line 3475
[  413.882869] binder: undelivered TRANSACTION_ERROR: 29201
[  413.884955] binder: 17082:17085 not enough space to store 0 fds in buffer
[  413.884981] binder: 17082:17085 transaction failed 29201/-22, size 120-24 line 3475
[  413.886615] binder: undelivered TRANSACTION_ERROR: 29201
[  413.893955] binder: 17082:17086 not enough space to store 0 fds in buffer
[  413.893989] binder: 17082:17086 transaction failed 29201/-22, size 120-24 line 3475
[  413.895950] binder: undelivered TRANSACTION_ERROR: 29201
[  413.928529] binder: 17087:17088 not enough space to store 2 fds in buffer
[  413.928555] binder: 17087:17088 transaction failed 29201/-22, size 112-24 line 3475
[  413.928776] binder: undelivered TRANSACTION_ERROR: 29201
[  413.993950] binder_alloc: 17092: binder_alloc_buf, no vma
[  413.993967] binder: 17092:17093 transaction failed 29189/-3, size 112-24 line 3284
[  413.997282] binder: undelivered TRANSACTION_ERROR: 29189
[  414.020533] binder: 17094:17097 not enough space to store 0 fds in buffer
[  414.020556] binder: 17094:17097 transaction failed 29201/-22, size 120-24 line 3475
[  414.022257] binder: undelivered TRANSACTION_ERROR: 29201
[  414.028187] binder: 17094:17100 not enough space to store 0 fds in buffer
[  414.028210] binder: 17094:17100 transaction failed 29201/-22, size 120-24 line 3475
[  414.028442] binder_alloc: 17098: binder_alloc_buf, no vma
[  414.028457] binder: 17098:17099 transaction failed 29189/-3, size 112-24 line 3284
[  414.028728] binder: undelivered TRANSACTION_ERROR: 29189
[  414.038051] binder: undelivered TRANSACTION_ERROR: 29201
[  414.246869] binder: 17060:17069 transaction failed 29201/-28, size 120-4755801206503243800 line 3284
[  414.451417] binder: undelivered TRANSACTION_ERROR: 29201
[  414.457137] binder: BINDER_SET_CONTEXT_MGR already set
[  414.457146] binder: 17060:17074 ioctl 40046207 0 returned -16
03:16:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000028000000084655515a73d54900000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:55 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @fd, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}], 0xffffffffffffff92, 0x0, 0x0})

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
r7 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r8 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r7, r8)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r10 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r11 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r11, 0x0, 0x0)
r12 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r13=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r11, 0x400454ce, r13)
r14 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r14, 0x0, 0x0)
r15 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r15, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r16=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r14, 0x400454ce, r16)
r17 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r17, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r18 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r17, r18)
r19 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r19, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r20 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r19, r20)
r21 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r21, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
r22 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r22, 0x4024700a, 0x0)
preadv(r22, &(0x7f00000017c0), 0x1fe, 0x500)
r23 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r24 = getpid()
fcntl$lock(r23, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r24})
listen(r23, 0x200)
r25 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r26 = getpid()
fcntl$lock(r25, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r26})
r27 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r28 = getpid()
fcntl$lock(r27, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r28})
mount$fuse(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x8, &(0x7f00000004c0)=ANY=[@ANYRES64, @ANYRES16=r13, @ANYPTR64=&(0x7f0000000880)=ANY=[@ANYPTR64=&(0x7f0000000640)=ANY=[@ANYPTR, @ANYRESDEC, @ANYRESOCT, @ANYRES16=r2], @ANYPTR64=&(0x7f0000000680)=ANY=[@ANYPTR, @ANYRES16=r3, @ANYRES32=r28, @ANYPTR64, @ANYPTR, @ANYRESDEC=r14], @ANYPTR64=&(0x7f0000000700)=ANY=[@ANYRES16=0x0, @ANYRESHEX=0x0, @ANYRESOCT=r0, @ANYRESDEC=r2, @ANYRESOCT=r17, @ANYRESOCT, @ANYRESHEX=0x0, @ANYRESDEC=r20, @ANYRESOCT], @ANYRES32=r21, @ANYBLOB="d12b32d6a1be610244d61280071d31b0a26f14c89bc31d7e26e1e7627e095133b36222106aa60682edf39b46813a7e1d843cadfddd006eca52deed1b51a63fc6c3e63a40b7a3eb2210e7f2b4d1b52f3f64af9cbba2547fbb0b9ec96b2ae140e2657d6d22b114efe87da4d2f3f08877c8", @ANYRESOCT, @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYPTR64, @ANYPTR, @ANYPTR64, @ANYPTR64, @ANYRES64=r3, @ANYRESDEC=0x0, @ANYPTR64, @ANYBLOB="ee293c49e25867fb50e6907cae7d4cc715743c2a8018c735b2e31e95d77ff9b9af510f3b5fbefcad3381950ea3042690c5d2ae8da01f7b84c84e4f547d8da800000000", @ANYPTR], @ANYRES32=r22, @ANYRESDEC=r23, @ANYRES64=r26], @ANYRESDEC=0x0, @ANYRESHEX=r4, @ANYPTR=&(0x7f0000000580)=ANY=[]])
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:55 executing program 2:
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a9370000000000000000000000000000000000000000000000000000000000000000000000000852a7470721ef9856ae1660a0b58ceb7792e450000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

[  414.541677] binder: 17106:17108 got transaction with invalid offset (5860667490266251304, min 40 max 120) or object.
03:16:55 executing program 2:
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  414.547900] binder_alloc: 17109: binder_alloc_buf, no vma
[  414.547917] binder: 17109:17112 transaction failed 29189/-3, size 112-24 line 3284
03:16:55 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r4 = getpid()
fcntl$lock(r3, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r4})
listen(r3, 0x200)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRES16, @ANYRESDEC=r3, @ANYBLOB="2c67726f75705f69643db859c4d559bd86a84dd37a6810427566f2f99e7b5ea55baafe9e683a9f129ec2924a96495ea05b67a0ccc201a590b7b3ea6453ebb84864080c8237648e2bd744aec83cc22881de024ee2bbbd9478357d5841b7aa9d3001514be6f0178ee0fe91810cd3da91209ec857744ad943295b54302297f01ddbb4f6604080e295a0a166c86237414a55831521", @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  414.548121] binder: undelivered TRANSACTION_ERROR: 29189
[  414.559495] binder: 17107:17111 got transaction with fd, -1, but target does not allow fds
03:16:55 executing program 2:
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
r7 = dup2(r1, r4)
syz_open_pts(r7, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r8 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  414.559526] binder: 17107:17111 transaction failed 29201/-1, size 96-24 line 3427
[  414.559543] binder: 17107:17111 ioctl c0306201 20000180 returned -14
[  414.559801] binder: undelivered TRANSACTION_ERROR: 29201
[  414.612543] binder: 17120:17122 got transaction with invalid offset (0, min 0 max 120) or object.
[  414.612568] binder: 17120:17122 transaction failed 29201/-22, size 120-24 line 3379
[  414.612696] binder: undelivered TRANSACTION_ERROR: 29201
[  414.626517] binder: 17120:17125 got transaction with invalid offset (0, min 0 max 120) or object.
[  414.626543] binder: 17120:17125 transaction failed 29201/-22, size 120-24 line 3379
[  414.626756] binder: undelivered TRANSACTION_ERROR: 29201
[  414.785680] binder: 17138:17140 not enough space to store 0 fds in buffer
[  414.785710] binder: 17138:17140 transaction failed 29201/-22, size 120-24 line 3475
[  414.785953] binder: undelivered TRANSACTION_ERROR: 29201
[  414.797830] binder: BINDER_SET_CONTEXT_MGR already set
[  414.798124] binder: 17138:17144 ioctl 40046207 0 returned -16
[  414.955340] binder: 17106:17108 transaction failed 29201/-22, size 120-24 line 3379
03:16:55 executing program 5:
r0 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r1 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
r2 = dup2(r0, r1)
timer_create(0x3, &(0x7f0000000440)={0x0, 0x41, 0x4, @thr={&(0x7f0000000240)="efcaec807830a62efd37fcec2ecb584ec4c1c073c8409f0dcefde8903d27757658d8bcd233af404acd2ed6fe28072ecbd623c4643ef2239445130814359d509ab1ff7e9f3c11a899a5863d7cca6b556291778297fae88450c8ebd9214aeb06d783464467627c9d7eac70002275a0ce519586fe6968b492da3b317bc10f9b769c3c07c27efd453bda46857e9738b67a05eb2f305df29ccabf4647da5fc0c4e4523f18c12bfd663d65115255154a4cf5d9f110a0885a0e3e5e0f87742a9bc2f64fd80aa110c7f8e30aaf5f64f811667b1495bebce2ce61351623f89d9c431da0b49bc4f12dac09621c1102a89c24c265445c54e03784f3e36d", &(0x7f00000003c0)="1b74c4bd56c717673be98f146283245ba22057f0dac6251f850b6d91d24fb7185889ab12ffc564ed4fe57a811d1694869d7fa893b8d315303656b74d6a51ef70be7d8b4a4eae6b013443fbc48de913663e59c94ade6c79e02725cb5d"}}, &(0x7f0000000480))
ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000100)=@generic={0x0, 0x9, 0x5})
r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000140)={0x28, 0x2, 0x0, {0x6, 0x8, 0xffff}}, 0x28)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0100000000003229"], 0xfffffffffffffd71, 0x0, 0x0})

03:16:55 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x108000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
fcntl$getownex(r0, 0x10, &(0x7f0000000040))
sendfile(r3, r2, 0x0, 0x8000fffffffe)

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/67, 0x43)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0xd3813d4c753dc5b6, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x1}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0xfffffffffffffe5d, 0x0, 0x0})

03:16:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r5 = gettid()
ptrace$setopts(0x4206, r5, 0x0, 0x0)
tkill(r5, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

[  414.965992] binder: undelivered TRANSACTION_ERROR: 29201
[  414.978209] binder: 17106:17147 got transaction with invalid offset (5860667490266251304, min 40 max 120) or object.
[  415.001342] binder: 17106:17147 transaction failed 29201/-22, size 120-24 line 3379
[  415.009801] binder: undelivered TRANSACTION_ERROR: 29201
03:16:55 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000440)={0xc, 0x1000, "a3ccc1e49bed0f306276bf192c4e9fb4a2465871a495d67afda9a7ad249a98aa549ff57a4475d671344f45dce8d0cea4c032d9e9df8305849fbd15cfe5c73be1221c40e93dc1ab8ba56b4195e6a46b5356c8c81350a8fc1c87009563bb321aebd759c4c4837755c0b3668a7dbcda26012632b1eba1ee71a1965346da9888f1bf70d2e7b37e006f19fcfcf2c0abb067fa0a954dd42bbb2739d6fec791da050567078d87624f74993f598013224d2d4386422ac27a7a094eb525d4e7f226dd798b60388b37613f1affb101c34c9988f060d23125cf591f6bcf3e7ad5c72e671878fbde51f92f0e692112feb0dbbf19dbdfd8510abf1dc45b723cb25cef85b37522004e19fe1a6802b86eeca56903358b0fff24ef4052208a81ed2816f0d8856ff9ba5edc0743f730129305292b2a0a41016693afea71bb026263c555861096055a96347b2e9267048db9645a045b2b69f372a34be58af1426a5af557575f0b3181a57b43937c21a6a87e816545d58ea6db43e2eb94bf6c4221d3993f60c0f8063b62ed6101b34e73ff2472ec6af739f9a234c6dd086a53ee07abb64dcf5decd803b9900b97d3889736ee105b0111acd0797ac19dfe019e3a495d10b033c92ae771f2ffd0c970bbe6694a59f5633b22a0dd3ffc654abc3bab2990e304cf35fdc715575943a48ee81483e373a88f5195be28a5d759a79309737c10370f168a064d86fd2929b58d229ebaa2224f110c9d6ccce15811a281aa956b7e1e50c8a11fa56217cbd9058e4b4dc09c47562c5acbc44199d10129df1bf721189eee9f96b73c0bb44af5088d9b845f8d72e42b0ababa5d1fefae9787ca876b7d2115ae55b79f0dbf3387e7d29a21a5e1190f83a5ffbfd3c7fdede728529ba451252f89df6e39fb7a395d300995dd7770187527318f9dc66e3cd64085b8d212bc3a41d232321b1cbf74af1bc915df9472ed4b3374c9402fcb82a35c40cfa51f37837317332c97a7d33f862076575eedafe78e6c0ef02b0ea3a3ea72b7e25c7cbc91348eec2de110af26b0e44b2b54a72682a3b07f9df7d1aba52e6e60b621eb82aa05829557fdc5b62d39a91c2c49cdfc245a5c44cd8c8fb0c0a4a4bedcd8c38f891576ee8629cc056c8f72e19baa466d426be951918077933c9a3325fa1a8c3a710f85947243bf1feaca3137483c0920c97aadb87196145cbe0a13cce80dc012e9616adf80dcbaac38edc8ff8983f657228a19e4e1c79f31af74d9075d1b0fcef70ae70915f97a31a30530df58652fa97b505a94216fa08e2a23cfeb0bf8403cc69f85bd37e933fbea6b69a889468b76163f9dfd9b258dbf0a5a3a0c0c803989c944ab3fa54be5aa0f151f7de77823a09cc849a5da07db8abfd3458cb9783286ef484e65142b8efb04a59dc02ae181efa9fb2bc7e5cf15d78d2e1a373932005e7352019d58a0b162b73c01f7f7ed10fbddab162e65d17787532c3b475675a6ddad5824872c3f7f8e8089155fa545221d84ed50988f6368c96ab64cad8cc53a297111a0e618a7d8d1d6e1291b397efdffe301611b529be99679925d3aabc54d4130df04b405f8933e857398366ba3b0e361fa6e074c4cbd13beda6e7294f50214a7eb2c388943de6a0bb40225551eb857252364b3cd56924b33cde54cd77a7dce981ae611d02c24eb8432b16a6f6b85b321f2a94078950923a981f2342ff5c3ad8cc594549ca8e4c147f12dd42eb16253984deaabfe7812e398f73e72198bca49d026a8b7dfd58214e8efdddb6a30e94bfc177add02db9acbd2452a56923d9dbb307b2d5de3018e8a87a8f83017cda4edaaa7c6cbdd886c3406137dd19d1724936ff4de42c60ca4b70d74a293a544258e6b1a6614b23ae22378f241f7bc2202b35113d97d7aa0128f7a4e02770234ebbdcd22913ddeea537d004541e03c2400a8046696b818185117d022ae8a8378c2729c8d24d24095a853e32a32750e2e3239f8d7e9f430185229a230bc0a1cdb62457f913cbdb901d71b043ed9fc3fe1592a66abb8d6f78d767c1664042d88e19b474846d358a7e588e3f698ff9978307d6f148cd1291c3242411071807cb7264de637a5a9751b3bda933520f98af03d80595d805600a479aab6e8c8d697d7493545992abbca277f63ad38b7dbe9d3ab6dafea82d5b1c736d684363bedb49d1eb4b4face78c88270c199e4c1b504b050576e3255e66c16c2337b4926906549c0b8c05cb89ab94aa297638a52015c0bd8cb14d6ba7f7a404136e7c816b36bd83e11acaf7ddbbf4d90779fbe95863caa03935f0fcfbfe9de8f4d0aba013d39cd4d1fdd531b94fb89909fa5430b6a05ff29566fcac1145011c02329ddf88ad8ba314bb7274970785799e2bde0efde49cf5705d4572077556591d2adfc2e59127a3de03c2bc8c60a72e123f00f739eb0f3d622cb264dfad9503a240e578fce6b3d2814df6a83931d76da46001c7fe31571ba3bf5d163de32b9faa5e54737454ea9a994a57dc134245636c4dd83cd14ae125517ce60803b8bf64b6be8e0ea224b54595e8ea294c24d46d0597f06286f1da960cb40798f2314716731088b1196e4b613a4efbb1d00e5e429a6cb728898aaf1130a88e705707a8ecdb67f53672d6b8cf523c72c50978256db0c082df36d46a976fa4227dcdabec1db1afe48b6c59d0a4ff03d06d69b9d724bc3531d38d3da50f1e08ed2325e5b082e47ad1ae69e0f4925b7c28930d5c68bf4e49c1b1ef046fabde59dca01c6eb186a285d0be366e17dbb14d3f6e85e5540b80fd2f33d0e96367be5e5a2c181df22c3f8f412bdfd2129b548bf594b203b6ef98e07388904dd996f620cb65377c436c803e831d88900f1d3ffba860d2197339015aa232134852f02d3fb5035982cb1cdb3da4188fb9d8fae9c601434d9e2717f2e6180df839a7cd1c8731a73bedf80881269f087a42744f64703e522053f504bfa6729849c8621366c016f121da55e8fdf8e9449206ff42659a3b2a2cf97faf27aef362f500116f9a50e4a01015fb82c6043441ba80a645d2af410a0a55d2e8275ffc0febb76ee61be2393ed42b160a5c70d7aae9d1d9a08b23d466deca8fd9f92d2001b42aae8153a8e7d09ab1608c2dcacb2cf8ac9850c69951aa5c0137b9009e7f2921f11e4111a24a2b6d23ce48dc3c9d43076dbe35659390137bc0b6fc2693cff7cc3fd4b802412806d9c32fb92226b00c362be0fe5268a5527cccf5d1985e4d810215858f7a856dbfd638629063e12d87d33afc2103efec317400a0dd5bdc24edf38ee73b279c3ad0e0d291d958e85f04f4ac1c390b032f6ae9134b9c6882ee8d49c16e27feb1866c454bf39f631429e6fd2452fb5dbeac3a43773db236c625ca8f732c50bf5b924ed2ec6e265da5ad9597aa55b748847a20c4e482f11ab666bb439516b309ea38433b517c4608b001056e2718992517a4094d227db06703a9612588e31a5909a42b6e77a76b41ee53a2e87ce9f0bdc66de148c01f114cb09a02015333f7f4e9071f46381ef968f519db7302960d54e21fa3d534488a8e1e001a80ac7cdc4e42b6c5f92c539b66f84229e8c0d220343ae4256342726df2e3e89f0095d7cf582f18b1c12e439867691c73ef19f146dca9e3f3952a33f38d9314fe7136a2aa8f5e1bf45f662ce06c9cf804c0162a3bb71d30ecd497c22ab9cc70ff42ce430269c67866d72c7fdbdafba0772d58ee9e13a7226875b88504fa05564d3f4014703b12c205bd0e8418ffeaeea574687e0616b09edfdd09f4510c65b3a5df3f77623e8a2ba60ebced0417b9ced10dc7d48b23384c68a720563bfc7b484addd03a7f694c08c5d3931b6ba940484b6824cb58a49423c124ee26cf1a355158b2f9dc744192667e073442d51580f25482b7a916a745f301752920465964f50592e1f8b1ef8e20f3cefb3ea4fb65b8e9ec5a5cf7f012b9958089064cb89709f644974225d91c0b8ed6d3cea038ce10d13b98f69e58a9d974b308e74436d6824e650d6b02e916c55117637310201ae62c6c2f6c083e2f7187c5065253842c94c434a4de2c8cdf240abff450e44179c8a71b33cca57b0f28f523dd0e183a187ca29cb2d859238156f890e848e8e6179d29782b711860175436066ddbefe514d8e2346b9395a241918fb27ed34d496b6aa851eb7872756de514b95a494597064708a26befc34cb9a481a49acfb9402662356f20db983e05765c3d11555221df1ad7ce94758aa446d306bd83047474c7dae8f308a124f8bbc33b528a356d9b8c3c45e9a96aa2f0ef993e52e16f38f65a6a632cab8b2dc983876e163cab95a8a4c6ee72df64a601944e281d37e4483b1c39e2633e980ffc36fd544ef5e51b50d2d012247f90eb876fb92facd1f2504950b205510b0abff508baaa856fee013e202566c8d90baa5af4f56ab418a1c94bc6468d9516d502676104874d326253c83a08d94cf2f314d493b0ea1377657571569c5bbc8df9a4f31774ec22d4dbc68c0b060e501ad600767c1ba3ac234e488ced2998f85e975ab2d33e662774a99d19ba5abd76a4fdd238fdd4cc4139261431377d6451810a037a6f121a3a399fb9be9663a185739106ab000b335ac12a453d10848f403c9a9c4b3326b000a1e410da386daa287a7aefaf2461c1e84f9e4d275a5d4a0dbe249deb4d48306eb91d6bb44e953833571ae479d2595b0131a854e5f0e03f034e28193a256563063406fe8d8c64ecec4fa2d9a252a5049891cb0a9c532752d9cd9648217a713e48dd184bb53e5644e759bcfa3e25fc89a5c404e966e71a11c125c0fbbd049a75e3ba656a5055bc9b14e73cae1e62ffeb6b1bd29b11d90b447233814bbeae0873e30abb9c4bf3a501691790d2cbc8689c4fa5f50be16237723dcc23142fe803e0b9fe76c27511a16e4dc68b1439d6edee6a7868eb06e26175e1334a78d151e2f8994f41603cadda0a1739ea2d84c167b2f2832285d15bcfebdcf68c012dff36119136b10f5a05f2b8ead3c24ceddcc2d92ee3ff2d7c44e0cf9590ece05d94492b1c319535536e630fb5ed8171478fcefcdb2e625d822673f4691eff58f9f02e966c5683da23f0d8aec388d8cc501d3c12e60aa88bc6587567f59d74ab95658e078ece0f5686d899010c44709727bab8c41fb8161ea62f9172e06277768dc59412c65159bd8e3dd59ce135cbc2800b2ca7bdd7f290769a382fc9bcf728d51bc73ed14027236df1fb2fc4031f18ab77ddb545e55b04ed0e08f60c73d795eb7672fdfc3da7233c06d8f04b39667e091552c7f95bc7c288cbaf467512d8e2853e6e2b10dccc21251fbbae68e4582f0c924c06600ec4c2b6c909969800deed3509ad8a97de49ae90e75a2006a2f7028d39a2e234ef7f3dec83aeeb17823e85202c42ea5dc87118e7c7026764937325de22508a644255c67cc0c2b490bfe0fbd069aa09267ae820f3f5c7f9780a15aa5905237967969bb0eaa88018db6e15140f86cd3cc4da1b82b424029dd2608d13d0073776472d1b26b0e41296bf20d25bd46ffb178d2d13ca5d3b67d4da0b56e148e72095446ea64fbe7e6cd8db094f05f7f56e32ebb4d6801ceb87246f7c96998b8a105fd0ac5ac3769554c4ed5a4b40831ca616925e2110333352e04fc96e05bbd80018b1f1170e1a4628aa261c352372939b46725eb628184556c42db1b0e7557529c936e377ee0a20642dd1ea3006dd15062f012bab00b65bda62be28e39aa5ad95fd208cea2b10c85997ec29b726ea911a5cd0bba1e45f9de1ecb192a6685c0e0abd52b6b387fb4"}, 0xffffffffffffff3a)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x87)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x5)
r4 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
keyctl$set_reqkey_keyring(0xe, 0x0)
dup2(r3, r4)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x800000, &(0x7f0000000280)=ANY=[])
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
listen(r5, 0x200)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000340)="9d4a6a317064f19705ec6124bc3f2c8ef01a82b2464d9b450b98605ff911e814bb144b5655c45f5a85e23f0e662fa7d2f3e2a20ffc1d5c87e0c3ced4f7a73867dd71ca311ca41e169bf9aab5d07135e96eb53fd6242651c7eb5e025b4ccccbf63d3e262d0dddf1db8e9ad2548ded6018613a9718bf806b31def1965a39df4e69fa02773378153e0564eb4a205a60f09f0ccb34a9a949db5f1d3343f69cd5f8d21078f83ee18e607ae4f8dcfc5dc30d26db31091e1ac43e690f7f607c18333b9648a7738f92668daa4c6a82eb98ba28f8eaf5", 0xd2, r5}, 0x68)
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.069548] binder: 17150:17157 not enough space to store 0 fds in buffer
[  415.089998] binder: 17150:17157 transaction failed 29201/-22, size 112-24 line 3475
03:16:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
lsetxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@random={'trusted.', '\x00'}, &(0x7f00000001c0)='\x00', 0x1, 0x2)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x54, 0x0, &(0x7f00000002c0)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_handle={0x77682a85, 0x100}, @flat=@binder={0x73622a85, 0x1008, 0x3}, @flat=@binder={0x73622a85, 0x1809}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x1}], 0xf, 0x0, &(0x7f00000003c0)="f65880b86a614d5d46316a5d7d761a"})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000440)='/dev/loop-control\x00', 0x0, 0x0)

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.104218] binder_alloc: 17154: binder_alloc_buf size 2968435104390578328 failed, no address space
03:16:55 executing program 0:
init_module(&(0x7f0000000040)='fuse\x00', 0x5, &(0x7f0000000080)='/-self]\x00')
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="66453d5f0d13fc0f3c95440d1778d9cebc838da30871d2061a3d5af133408543d84409cd882437cb1e4282c0f1981af2deff2e19c0f9651095de172fb49e0b5cea87cd73fd4b64352c74ffbcb4feac66a1bbea54befe319dff1eec52eaf4b591e74ff2cb25075207114da96032cb3fb196e16e5e005403830f0f2db7eaaca4c046c20981ecf51d6d685cecf11289b822ad7a01631f9c894c1429d5913a8a88e3aaffee456ff9a852ba6ca292b8a2ee7d8a5d7e2de18e6c2878af89e68696b8ded62facd58127f6ac2a47ad5f791a0d6e3d847e706887d4c715ba41f56827975b878fd2b22db2f43acbdc4a1dcef5eea0c583bb1e53f0d08a386a61da2df3f57d88488753c7283859c83313e108e9bb8daa7cb0963ad4604e7891382b09ff88e86c7e535e070dd2e591704c0eb2025dd3ef80823469fd8cc4906b3d5bea6558", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000\x00\x00\x000200r_id\r', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0})

03:16:55 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.104226] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  415.104331] binder: 17154:17158 transaction failed 29201/-28, size 120-24 line 3284
03:16:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f0000000100)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:55 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, &(0x7f0000000340)={0x1, 0x2, 0x1000, 0xb7, &(0x7f0000000140)="25ec0968006b30218b081eaa0c083601f021cf2091bd4c98007f9ab2dfce2d8b6a3af2ec535f0ab9bee680db00567f32155011859fa6ecff1ff1df119879952075603a6205b527a0b93938ed939f10f748829d8388bdda71748066cf037f28d3c58a027261a41b6ff65eaf9baa01228dc31f78d427d5dcabbd64d0d3c6cd9811db97d5fe0e42b9ca63989b8a795ec919125e0fea9b4836ee52e19b021559a47b52eb79bc7c9873a96240595593fbca95d6d9863ab4268a", 0x2e, 0x0, &(0x7f0000000080)="a8a006088c0f76dea9be440d92a61f8de1b1ab2e11fbb5e91dd9e6ba636c8c523cd7fa1b2aa749a55bd9d1185d39"})
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

[  415.104346] binder: 17154:17158 ioctl c0306201 20000180 returned -14
[  415.105142] binder: undelivered TRANSACTION_ERROR: 29201
[  415.159765] binder_alloc: 17171: binder_alloc_buf, no vma
[  415.159783] binder: 17171:17173 transaction failed 29189/-3, size 112-24 line 3284
[  415.160078] binder: undelivered TRANSACTION_ERROR: 29189
[  415.173908] binder: 17175:17176 got reply transaction with no transaction stack
[  415.173916] binder: 17175:17176 transaction failed 29201/-71, size 72-24 line 3046
[  415.174159] binder: undelivered TRANSACTION_ERROR: 29201
[  415.202822] binder_alloc: 17178: binder_alloc_buf, no vma
[  415.202839] binder: 17178:17181 transaction failed 29189/-3, size 112-24 line 3284
[  415.203094] binder: undelivered TRANSACTION_ERROR: 29189
[  415.249563] binder: 17184:17186 BC_FREE_BUFFER u0000000000000000 no match
[  415.263198] binder: 17184:17188 BC_FREE_BUFFER u0000000000000000 no match
[  415.266784] binder_alloc: 17187: binder_alloc_buf, no vma
[  415.266803] binder: 17187:17190 transaction failed 29189/-3, size 112-24 line 3284
[  415.267051] binder: undelivered TRANSACTION_ERROR: 29189
[  415.319890] binder: 17191:17195 not enough space to store 0 fds in buffer
03:16:56 executing program 5:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff})
r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r1, 0x4024700a, 0x0)
preadv(r1, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$FS_IOC_ENABLE_VERITY(r1, 0x40806685, &(0x7f00000014c0)={0x1, 0x2, 0x1000, 0x0, 0xfffffffffffffffe, 0x8c, 0x0, &(0x7f0000001400)="b080c75175ba82263d83d199363bbd315792554d5473d27fad7640aa28a51fc345b5dbf734b4fb3c239c88ddf3d5bc24f87d9f7217d9c80ef72993a5a083ec5a22815d209b610806a6233e732403ea870ea67921c5a203fcb6db49f98e8e00d70ac5c25cfd57b75e889dbd5302b2429e92b22bfe4ef4087ae4b5903c653b35abb04ff8f6f6f68b06695ed233"})
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)=<r2=>0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000001c0)={[], 0x8, 0x8, 0x9, 0x81, 0x0, r2})
r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
vmsplice(r3, &(0x7f00000013c0)=[{&(0x7f0000000240)="9426f48b501847a39657836ee326864b81a65ef17c1f45f5d7bb77899408c622ee61d7f1e3517262de1364d35d05952359604820bfcd1d65274935aa49536da9bc6c8a0ff68ff5cb66a75a94133d14bf7ffcb2544e2b0519c2f4354f36ab03cc57c6187ce88c3e62593ba4", 0x6b}, {&(0x7f00000003c0)="84718a66d1bf10b86e079fc42b777f1d4b1f244195455096288dbd139a158db028beb61ae1d8268010b069b04fd45024213bfc6c44c008fec749af6a4e3034b7c74789391d48c87cc09c4c93ada3693a7354191dafe24a76342e4d95763dcf12ccf1adfccbcabe0e1a0c4ae75c8e805740e97270b0846ae6174a857ce132f1ed8665b7c3c8c06d507f0c0c13555c575d56148b9918cddbaab95ae6e61abc2003879697337f646af3f37c6e71ee698f58a71630c6eacee63d1111b2ab4b3023f06e3e3b1117e66ea8d0e1a31d37372d38e01ad00b3f42b74cc8fa56eddf188022dbc74bc2836c00258095cc34949caf864ef1e3073371f8eb6681778f26af5d8b91d9d5c6c4a983a94a910dc2a60a5927067c7268b073470b09c9462f78580235b5f7906ecfcd9b75e9cab30216722dd7cc9363b44c04459fa0428efc65c5ce2cc7ee2a025611cb55b9841c53fe8ecd031b143455d88214abbc24c74ec818683ec881ba9ccb28a167f388a4fd99f5e5e196306197142790e5c3e2849321df1c507fdb50383d77e054fb7aa42cc3b860a3de993cde07636bce3ebbd56a206c765cfa4f121c6c52791f29d649f6cbccc24b7b04672a6a55384bb545f42b2b63a97ee1691b661cf1c3a39bf828b16c7d4a7bbc70936294a3e1247f8fa03b5912373333ff6cd5e7a3f2bf3d70bc4e02203b228e70ee3f4dd38448c816ec50a377c335d2d09841f8b0903ee03d3cee19bbb823ae803aadb8a7faf60c28a472950410ef4b5fddba896f40647030137cdac1ac70de71641a7ec55c914050710e9729af41964b8f15099a2f4ab86236c34b9c71d1f91eb4437f3f9e0ab813c0c1e290a45174a57a0514e93a83b35be8f2c54735b45decc34fe21bbecaf4b19c3f1227a60d9f4d4b426f3aa8a0962d93d36772033d8c7b4794f84575a79daae4f35df77028eb68d25a26d0df2b6a8b4f830e89a6eab1136cc2ffb6c8ad4d766bc0349bde8e3c280033f429635257002d51baabbbea6854dacceb87d7dbee21750ae45d6ad1e074345b2302f460308ca2f597b16f8e47bf9985a3c34dab192457d60a2324c3b826a46ea4b7c678c43687dbb932cf6b4c02968310dfeda24f93e8871e3cab2662e99252932650cbd7b046dba9c33cf1091b6a1dfd40bb095ec71df2945ae388382933e7877eeadd260c8506aa46b0fe337952c387018695cb2ff25d72a82702abcfe579ec02e9e99bc5d566cc3cb8aacee60e2a795bf5434df98b604bc87debabee5b921d7d90a894a8b3b2b23ffe72a102019847b5d948e32429f899359ecb2bb67d9ea6c49b2f2cbafde3812afa8b3c1fbdabdc3b7b9b5032d9189b76c76f6b6bb037eaa01dbb35f27305b5197d75bf9ec0155b850e2735dc944e30d6fc3ac5b98c1743cbdbd355934d38c24501496a1d523bbf8fd1321c06f6c2620e0d6add5adc05d71ce27682631b23a3cc6e9fc720500fc3dc037cbeb862b33f63b0b1d46769b374d383899b7745550569b76896f64c27f5744acf5a77eb9feee0f66ff076f151c1f000f9791a152012cf7c71f9266881bb0bc7b2f4135d297e6e7c82cfcbbb4b73183f67d3081e0b182accd582e67c9d20e7f9f51140386b6bdc2b0309aca1979ababf667360756521f7385b5d0f09d958790fd1f906b64bdc618095bd30180a33770091ab19e775940a0797eae0fafdde45cf5342ec7be073257c6f30b625d19417be2ff739259e5fd12a255c2ebb9253a96b126cd132852c5c271cc20be030500326a555c8affbc0341488b60d4e855db973797d3a86ab30336dedb13d78790b9fbb3cbd6c89054b09f8be7e491cdbbb9fca30edee234fbf815baac8c8534538272f5b7deb0a1d5efb4d1905af33543a4caf72aa108129b36f3b98dcca527029ead57a5cfd6d83505e6e3e2f89fb95140e9c191dd1f11f43379235979d940c3982838be97cee165b4dd9c885654ecb2b61ba8efabb903d47c4502ebf14380fc370b2d0a5581ce12fa7cd351f74c99fd756c31e2d915309bf0580708491f79058425735de7f0c61918d60b40f10f49f0bb90dccc19d775a1ebc0db367cf59e700c72e6a191853471c2ccf4a563ee19f2d895a0b2882997066dcbcd614b7c1d810e451ffba2084e4c42bcec81fc3a327e5294c0ac97ec148315fff3f3f33abf549f8e89f337b1d07d52bbea90c6ee955b4873b0b6f9784257b1378642a2f81077cd95aff2360f3d9693cf71b4888deafca474f653711393af45b3613d291c67720151f0505f849446eb4b9a5b62f0611fffb1cf28053bfcf915ec94b980b8ed2b1f7851e7d38f494ebb1d65a55e7ac58e93cff42444b2f2e790cfeae30ee18c29faeea55063f1195a6ff2de7250c3b2e840e400d4891f70ac22517bdac11c68a8fd74f3c3942b165d83b767996ed12b39c1ff54b483ba88acf0e0f2f80ca5c68b74b20e0d4e0a98f84ea929099e36d7acef9bc40aa5184be234830d9f6f7d57b59edefce6c9ee8bb689f381ae51e91195220b54b06706b604645c08cf937cdd69fe6bbf823b1f4565339f7e9203a31893a194c2b8cae5b912d519aef6032407d6c73b632449436e4f6a539d592e5c1d4b0e7ebc7d155e620369159ba2629b92eb3f1eca42ee60dfa6e08e3ec2021172430938e9c3f8ca37977dca16ae32ea911b0ba38da5e0a580bd98a1c4795b4e64a717b27720ca187b416475c9e22a92de47f19977c2d4e698e29c725045e6443530f4e2095668869c405e2980ab2777c65185a889d0ab615486930644747a7a6db992cf16c0e2b61f49d6b700e162afa4b3520abdfc7375204d8a9d79595cf9587c972da1b9c641df154d51952a5d2f331eb81ca6298c633b366f17e4f4dc096add21c0b1d60bfa7a7c1e90fbdabddaeea5ca95594ca12d1fdeda6fad09deed7d990acb27d969a0c121360ec5eb97921315169836644e0f678bdfc9cf02d41d16d07c77fdfb4de059dc1b37b4e8d54bed2b902e7a6e75639ab4c0459787dca519e58fffbb623f02f3f5a6e482320cc16611c1933c2185d9379a43685aed9cc835d99ebc5a772e32fd31f52ee477617bc6224cc7b4ad3007af1f00e62a4270058f72ccf7fce8e67895de960daf89624db64682e53268dafccd879be874f39b8887c61354c09f0ca85a7a6327cfc52d67a58d21e4a6fa503bf4da673c5c6f6c382e4883462ef2bf666cb10d7580784ae923436b3c8e05aadfac4f081bd3e5ee100783f2b8e12f490d1f5d97eae2a61144a26852159455f112580e33862a6aabe904b0a51f59ed0729da10bfdd67a9af9568e25b08c865d3f2a91fda6f1864227f4ef2b0ea92eb8c89f19c0edd693e803bd2a5bf796eb7d9c996e3cf9cd616c1e6e10f26e4ded1652b67ff10d9153b04ba0f08413f81f68174782795158685d5156517a6945c07074eec0ca3e25e5e11a4af0d1501d0a3ba8c825795927812c38ec6c4910934da0b921b08249c889cee02f0be91874adb59b62f866cd4cfa1aad480cf7f7ca93b2302844b41b296a7de2ca39369910ab1348d55f31c37a12b13820ebd3fa9157102db7d6950211e86f23a802fd1fb18f3e9484909236dbb66cc801a18356482e68c47100a6898b6fb5db4619d2c8c998c90ad83b263dc5f6d107efe352768e6770c006c2ec544679d1a409c56bb530bdd62277754be3936b4a30811f01ffcb28eb7b307e6617f896583558df71f57142f5eb7b050b3f3d24537eb18f476614f6ab24445a574cb6793f1b08caba48031700e850a426ebdd2f418725309c37918eba742a5ae365b012e27e83a7bafdcf89a066ecabbd672f5227b28851b7502fd2e8404589d9f5a7b4d5eb0ba56e31b67aa3da646db5dcc245531f7f870be4ce989ee4dabc66aef06cc7300e65262bb9e3f046a9cc7a39c9023701406424fc40828e421cf5b11f0af0296d9b45b84f4565588b1ea8e4f8a738e9c81bd4d27cee3ff7c7f16ef06d2f71db472c6acfd77dd6dd359ceabe2ed8c5283e57a74f1fd1b9624eb17f6da33918cc4b5fc1029de5336a300eac35b11b3d3d548891facea45cb43ced874da3ea171adc65b7d3c9df26d5e53f21002456577758ae970bff0865d2c6e15484b9699e389da536b1a0ac7407d0a52893b9f26137cf66121cb0e6d38a9e8a5ca2fc66782998164ae129bdefcee4052701d4ecf239d66eaeb5632b87523f80ad9993fa1756e5dde3494e3cac6f82ae8183a75713d243fbfe14bc1ecdcd5a59557a47307291f410049b040437afe566530ebf174ebe1d8188cf6beb2a57de07740b9f1faa1c81f211b442067b2a5768954ed8a1372916dae5554b9de51e793ca0f2ac81751918d404ed462aa3da59bf583b3c67491e245424619a6a2f06067a5005e89956a8f2778e405fcae50238aee342e8b6eb50ed3733bc94f5f6602106a3ae479a8a60e55686b1ac5de3f039cc80be285956df1b7de90e1cf848ea47e5e6ab8b940c33be72805fd497d170ab0208914ab03aa62781f8ad3f071c350d92917cd933c3064195d2c84d6dbdf50113d53f3568b0a8aab71749ad51a86afe636c3efa6a442891b5dfa326a62173cd458becd7b84e960875244a5e44e7d1b4dd06cd3a20962edb0eb64717d41fb51dff8041577672f9b625ad3b2c92beabda404ab9bfd1facd41c53b859ff58c90448ac4dc3af2475da4d2aa62e315eebc6fe0428af68c772234bb49160bc640bf83e6f17db4f2d59598a0e0e9bbdec887b51525062ba92f7a2c8a7a4f1b7d5b75b0d3f489cfead058e8569c8a81e159281e2e5f034dd8e059ec32f08301f94d817fcaeb9b558083537cba29039fec54aae2a7bdeded9a349e0c864cc08bf2d67e8631a4148351bc4a8a65c19f318dfa20222b70accb627c8605e983969273724c43bac843971770178fd390a06da921f9e3896179294d838c0e628be129d4278eaa2063909551e29cd629c0dfab8c79e85522ca455675f0eb3b3e26c4f6d24cb776dc70bfc09b576595ee2a662eeb5fbd4079a17da7cf9f0a100107d6f81b60a3b101411ea5b10ad03cef7b9fb12747cb11f22458d652492c3b871cf89e9085706bf164e9e1095fba1e33cf0535d8939b19d96139ad2784caa59c3be4edf28eaeee0923e41e79674cfbb559e63b45d53a7c24df94a97a07514afa0bdf91fc0bb091b37c38a48402f633d1873b20e718c6bd20bc981dcb999c2881a76f2e42c7ae693ae2f95537b959f330e7e62bbbf9dcf8d7368dadd9f9afc219a6206a168f33ce056d5862b7b369be39a5178b88d49453e76810dd2278556e15843cfe50995ac664478ad2802d9e09f771a8d972be6e7490cbef25a184a00f578995777dfd24ea5eb414f5901c176d34eb66cc12075a4a085849f384a199fb67b777d4ebe161d115b9d7e557784ac2274bb428a1855f061d403b89e9da9b861c92a246d29b15109cdffb1025e851a15fd27a3c8561394d71be9e0978383bc9d47ae7da548eb19a991ab9af1f213bef53d76777ab9e68ef39c3e3b61847a811373af9dcc7d61ac541001987f0d7ac24f45deef47fb97b91d33e72c51ba636b17ce7930260a79badaf9d718af261323c086a624ef7ca7cc38f410da384b1e5e36d7f03648630a9b0ec6106787d32e2055ea32702c43fae612e08ba3142109f9caebca711d80a535e3e82be916176f40f9819242953fa7c0183523524071f392556b7fd9aaff045a019a44f40e1eb0f05d0f7ba22719d1f505a0a807772172101f1ca7ed93e5f4a14134bf061639c316c8b072421f5e4c5ea328ee32468e4", 0x1000}, {&(0x7f00000002c0)="0875884f3030806aaed58d6b86b1c447fb3e2ebfbaf037dae2357101112490c824c84c883dd815bd317f3961ddcd2af33ba8d23911ce2b3c17c2894f29313cf729d083d84f4f6a31586894c0e983", 0x4e}], 0x3, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r2 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r2, r3)
ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000100)={'bond0\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}})

03:16:56 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
getsockopt$sock_buf(r0, 0x1, 0x52, &(0x7f0000000340)=""/202, &(0x7f0000000040)=0xca)
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r5, 0x10, 0x70bd26, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x18044050)
r6 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r7, r6, 0x0, 0x8000fffffffe)

03:16:56 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, 0x0, 0x0, 0x0)
tkill(0x0, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:56 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500)
r1 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)={0x194, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [{{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x4, 0x1}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x4, 0x3}}, {{{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x4, 0x3}}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
sendmsg$DEVLINK_CMD_GET(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000001}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x94, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, {{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}]}, 0x94}, 0x1, 0x0, 0x0, 0x80c0}, 0x4000000)
r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.319918] binder: 17191:17195 transaction failed 29201/-22, size 112-24 line 3475
[  415.320061] binder: undelivered TRANSACTION_ERROR: 29201
[  415.326046] binder: 17191:17196 not enough space to store 0 fds in buffer
[  415.326072] binder: 17191:17196 transaction failed 29201/-22, size 112-24 line 3475
[  415.326299] binder: undelivered TRANSACTION_ERROR: 29201
[  415.492791] binder: 17150:17157 ioctl c0306201 20000180 returned -14
[  415.500845] binder: undelivered TRANSACTION_ERROR: 29201
03:16:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
delete_module(&(0x7f0000000100)='wlan0\x00', 0x0)

[  415.539559] binder: 17203:17208 transaction failed 29189/-22, size 112-24 line 3138
[  415.551981] binder: 17204:17214 not enough space to store 0 fds in buffer
03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 1:
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, <r0=>0x0})
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000040)={0x8})
r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r3, 0x4024700a, 0x0)
preadv(r3, &(0x7f00000017c0), 0x1fe, 0x500)
r4 = socket$inet6(0xa, 0x3, 0x87)
connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c)
r5 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5253a966ef325efe, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4000007, 0x1}, 0x0, 0x6, 0xffffffffffffffff, 0x4)
dup2(r4, r5)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xb7, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="11634840020000000000000000000000000000000000000021000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000900)=ANY=[@ANYBLOB='\x00'/232], @ANYBLOB="e80000000000000001000000000000004000000000000000852a62770010000000000000000000000000000000000000852a747001000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB], @ANYBLOB="010000000000000002000000000000003800000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYRESOCT, @ANYPTR=&(0x7f0000000680)=ANY=[@ANYRES16=r5, @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB='\x00'/243], @ANYBLOB="f30000000000000001000000000000000700000000000000852a747001000000", @ANYPTR=&(0x7f00000005c0)=ANY=[@ANYBLOB='\x00'/170], @ANYBLOB="aa0000000000000002000000000000002e00000000000000"], @ANYPTR=&(0x7f0000000700)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="001000000000000001634040000000000000000000000000000000000000000001000000000000000000000000040000000000001800000000000000", @ANYPTR=&(0x7f0000000740)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r3, @ANYBLOB="000000000000000000000000852a62770b00000001000000000000000000000000000000852a68770a1000"/60], @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, 0x0})

[  415.552007] binder: 17204:17214 transaction failed 29201/-22, size 120-24 line 3475
03:16:56 executing program 5:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r2=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r0, 0x400454ce, r2)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x76b230a7d1070a48, &(0x7f0000000100)=0x8, 0x4)
r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
fsetxattr(r2, &(0x7f0000000040)=@random={'security.', 'fuse\x00'}, &(0x7f0000000080)='/dev/fuse\x00', 0xa, 0x3)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)

03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x804)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.552472] binder: undelivered TRANSACTION_ERROR: 29201
[  415.558094] binder: 17204:17217 not enough space to store 0 fds in buffer
[  415.558119] binder: 17204:17217 transaction failed 29201/-22, size 120-24 line 3475
03:16:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r2, 0x0, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r2, 0x400454ce, r4)
r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r6 = getpid()
fcntl$lock(r5, 0x7, &(0x7f00000001c0)={0x1, 0x0, 0xfffffffffffffffe, 0x3ff, r6})
listen(r5, 0x200)
r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r7, 0x0, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r9=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r7, 0x400454ce, r9)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0xa4, 0x0, &(0x7f00000013c0)=[@acquire_done={0x40106309, 0x1}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/4096, 0x1000, 0x0, 0x33}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r5}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x400}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000200)={@flat=@handle={0x73682a85, 0x2001}, @fd={0x66642a85, 0x0, r7}, @fda={0x66646185, 0x4, 0x0, 0x14}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}}], 0xa3, 0x0, &(0x7f0000001480)="3b994fecd5bc1fdd1f28ec73279eace51f54016cd84b5d13a5dddf6a2cd79035bd0ec7ff2aeb8938383db50c6c4d4708a7b499a5b28b2f09bad53ffc2bf2356a90f41c30f67d8001a93d70b4a86efa505738fc085938bfc77cf3b931f3ecf8bc39267dec7f5fc895d6378cd4805bc35688b2ed25bd84efcaa53d4e057fce73187a1f1c7c07d7ca59c8d16c7f801430d6d3635deb8192664ec38ad1ae70ca7b9c7c9dd9"})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  415.558424] binder: undelivered TRANSACTION_ERROR: 29201
[  415.564764] binder: 17207:17211 transaction failed 29189/-22, size 120-24 line 3138
[  415.564920] binder: undelivered TRANSACTION_ERROR: 29189
[  415.565551] binder: 17210:17216 not enough space to store 0 fds in buffer
[  415.565572] binder: 17210:17216 transaction failed 29201/-22, size 120-24 line 3475
[  415.566252] binder: undelivered TRANSACTION_ERROR: 29201
[  415.569424] binder: 17210:17220 not enough space to store 0 fds in buffer
[  415.569446] binder: 17210:17220 transaction failed 29201/-22, size 120-24 line 3475
[  415.570010] binder: undelivered TRANSACTION_ERROR: 29201
[  415.624899] binder: 17224:17229 not enough space to store 0 fds in buffer
[  415.624925] binder: 17224:17229 transaction failed 29201/-22, size 120-24 line 3475
[  415.625244] binder: undelivered TRANSACTION_ERROR: 29201
[  415.638914] binder: 17224:17231 not enough space to store 0 fds in buffer
[  415.638941] binder: 17224:17231 transaction failed 29201/-22, size 120-24 line 3475
[  415.639221] binder: undelivered TRANSACTION_ERROR: 29201
[  415.642024] binder: 17228:17233 not enough space to store 0 fds in buffer
[  415.642046] binder: 17228:17233 transaction failed 29201/-22, size 120-24 line 3475
[  415.644016] binder: undelivered TRANSACTION_ERROR: 29201
[  415.655935] binder: 17228:17235 not enough space to store 0 fds in buffer
[  415.656002] binder: 17228:17235 transaction failed 29201/-22, size 120-24 line 3475
[  415.656254] binder: undelivered TRANSACTION_ERROR: 29201
[  415.687868] binder: 17234:17237 got transaction to invalid handle
[  415.687876] binder: 17234:17237 transaction failed 29201/-22, size 104-24 line 3138
[  415.688105] binder: undelivered TRANSACTION_ERROR: 29201
[  415.725840] binder: 17241:17245 not enough space to store 0 fds in buffer
[  415.725868] binder: 17241:17245 transaction failed 29201/-22, size 120-24 line 3475
[  415.726017] binder: undelivered TRANSACTION_ERROR: 29201
[  415.730399] binder: 17239:17246 not enough space to store 0 fds in buffer
[  415.730425] binder: 17239:17246 transaction failed 29201/-22, size 120-24 line 3475
[  415.730658] binder: undelivered TRANSACTION_ERROR: 29201
[  415.734275] binder: 17241:17247 not enough space to store 0 fds in buffer
[  415.734302] binder: 17241:17247 transaction failed 29201/-22, size 120-24 line 3475
03:16:56 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800)
syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/ppp\x00', 0x2, 0x0)
r3 = syz_genetlink_get_family_id$tipc(0x0)
sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r3, 0x8, 0x70bd26}, 0x1c}}, 0x0)
sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x68, r3, 0x300, 0x70bd2a, 0x25dfdbff, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x1000, @media='udp\x00'}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20004806}, 0x4008000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000078000000080000001800000100000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000100000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:56 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, 0x0, 0x0, 0x0)
tkill(0x0, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x1, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 0:
creat(&(0x7f0000000300)='./file0\x00', 0x0)
r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r0, 0x0, 0x0, 0x1000f4)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
sendfile(r2, r1, 0x0, 0x8000fffffffe)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
dup3(r7, r1, 0x80000)
r8 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r8, 0x4024700a, 0x0)
preadv(r8, &(0x7f00000017c0), 0x1fe, 0x500)
read$char_usb(r8, 0x0, 0x3c53b50a42b1841c)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r3, 0x400454ce, r10)
getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f0000000040)={'nat\x00'}, &(0x7f0000000140)=0x78)

[  415.734445] binder: undelivered TRANSACTION_ERROR: 29201
[  415.745246] binder: 17239:17248 not enough space to store 0 fds in buffer
[  415.745268] binder: 17239:17248 transaction failed 29201/-22, size 120-24 line 3475
[  415.745581] binder: undelivered TRANSACTION_ERROR: 29201
[  415.796839] binder: 17249:17251 not enough space to store 0 fds in buffer
[  415.796865] binder: 17249:17251 transaction failed 29201/-22, size 120-24 line 3475
[  415.797167] binder: undelivered TRANSACTION_ERROR: 29201
[  416.054720] binder: undelivered TRANSACTION_ERROR: 29189
03:16:56 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

[  416.084749] binder: 17258:17261 not enough space to store 0 fds in buffer
[  416.094575] binder: 17258:17261 transaction failed 29201/-22, size 120-24 line 3475
[  416.107634] binder: undelivered TRANSACTION_ERROR: 29201
[  416.111464] binder: 17267:17270 transaction failed 29189/-22, size 112-24 line 3138
03:16:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x88, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/45], @ANYBLOB="0000000000000800010000000028e126f91e6f123312f77c"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
fsetxattr$security_evm(r1, &(0x7f0000000140), &(0x7f0000000340)=@v2={0x3, 0x0, 0x19, 0x6, 0xcb, "5616ef3e7e6f4c625302a5671e8fb9be6e1eb969fa25d9a36190cb563733103d49407ddf463727b87ff266988aef039ab3a893a3f846e5ea1b8315cded5187170a1c0c342cd58a1e009d9df749ea78faa365c1e22444f8eccda15a242575d0c0f75986bc85f4a63126503273d9c81893802897c1c496d82c0b0c2a3a758ad942ad0fd0a8e8da2aadd6a954cae571e29ac46489d38d733592c4b9d25fffe2c73cea47c21304cd01dff741bc76938fa3d10586f9232d37bbf0672331a4434b124cd2a3fa35b93bdabb0a582c"}, 0xd5, 0x1)

03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@flat=@handle={0x73682a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000100)={0x2a, 0x4, 0x0, {0x4, 0x5, 0x2, 0x0, [0x0, 0x0]}}, 0x2a)
seccomp(0x1, 0x1, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x3ff, 0x9, 0xcc, 0x58}, {0x3, 0x80, 0x3, 0x4}, {0x40, 0x2, 0x5, 0x7}, {0x8, 0x80, 0x0, 0x80000001}, {0x9, 0x2, 0x0, 0x6}]})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

[  416.124897] binder: 17264:17268 not enough space to store 1 fds in buffer
[  416.124922] binder: 17264:17268 transaction failed 29201/-22, size 112-24 line 3475
[  416.131054] binder: BINDER_SET_CONTEXT_MGR already set
03:16:56 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xf1d35b5f6931dc13)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1163484000000000180000000000000000000000000000000000000300000000000000007800000000a0274fedf1cf4ccd02663e5f099cfbf8a8811ec164fd4115fc8e420a7ce4f3dd6ee9d4e880848a34a5b276496fcd5ea263117a5e4ef757ee850723125ddb54841917496d890cdc2cb037859ae21fdc8b6d3413492797fe1d260ccfa730791e60b2ccb0d527159021db3c41781b2f4c461e488a84d98cfb31e117408c4a47b6ae08158ccb15932d75cf89a1d176943734965177a8d96aa71c504454ded0d2aeffcd6cd0ee5496f094ed580e748ed925aa289f7469f64759c98de8a75463fecf75c37551453f5c3d69b1b1125df4f68bc415fdb3391558cdb70ddb3fcc5c453e8052aeb662f245c2e5759ffb644c9a6f3018d600"/299, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:56 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = open(&(0x7f0000000140)='./file0\x00', 0x10000, 0x20)
getsockname$packet(r4, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14)
r5 = syz_open_dev$binderN(0x0, 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0xf, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0xffffffffffffffbe, 0x28, 0x50}}}], 0x0, 0x0, 0x0})
r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r6, 0x4024700a, 0x0)
preadv(r6, &(0x7f00000017c0), 0x1fe, 0x500)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
write$binfmt_elf64(r7, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3f, 0x0, 0xff, 0x1, 0x7, 0x2, 0x6, 0x7, 0x281, 0x40, 0x144, 0x8, 0x5, 0x38, 0x1, 0x2, 0x5eb0, 0x401}, [{0x4, 0x10001, 0x1, 0x0, 0x72134973, 0x9, 0xba2a, 0x5}, {0x0, 0x2, 0xfffffffffffffffe, 0x7f, 0x5090, 0x1ff, 0x1, 0x7}], "7ea2da0d0a673e726d410ff61d80793c5b6731c00873bfb92136aa63", [[]]}, 0x1cc)
ioctl$KIOCSOUND(r6, 0x4b2f, 0x80000000)

[  416.131087] binder: 17264:17271 ioctl 40046207 0 returned -16
[  416.135438] binder_alloc: 17259: binder_alloc_buf size 1073742848 failed, no address space
03:16:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176)
ioctl$RTC_SET_TIME(r2, 0x4024700a, 0x0)
preadv(r2, &(0x7f00000017c0), 0x1fe, 0x500)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffcf2, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000100000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000001400000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES64=r2], @ANYBLOB="0002000000000000"], 0x0, 0x0, 0x0})

[  416.135445] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  416.135460] binder: 17259:17266 transaction failed 29201/-28, size 536871744-536871104 line 3284
[  416.142233] binder: BINDER_SET_CONTEXT_MGR already set
[  416.142244] binder: 17259:17274 ioctl 40046207 0 returned -16
[  416.149625] binder_alloc: 17259: binder_alloc_buf, no vma
[  416.149643] binder: 17259:17276 transaction failed 29189/-3, size 536871744-536871104 line 3284
[  416.188429] binder: 17275:17281 transaction failed 29189/-22, size 112-24 line 3138
[  416.200988] binder: BINDER_SET_CONTEXT_MGR already set
[  416.200997] binder: 17284:17286 ioctl 40046207 0 returned -16
[  416.203352] binder: BINDER_SET_CONTEXT_MGR already set
[  416.203360] binder: 17285:17287 ioctl 40046207 0 returned -16
[  416.204199] binder_alloc: 17258: binder_alloc_buf, no vma
[  416.204216] binder: 17285:17287 transaction failed 29189/-3, size 96-24 line 3284
[  416.206786] binder: BINDER_SET_CONTEXT_MGR already set
[  416.206793] binder: 17283:17288 ioctl 40046207 0 returned -16
[  416.206995] binder: BINDER_SET_CONTEXT_MGR already set
[  416.207002] binder: 17284:17289 ioctl 40046207 0 returned -16
[  416.207057] binder_alloc: 17264: binder_alloc_buf, no vma
[  416.207072] binder: 17283:17288 transaction failed 29189/-3, size 120-24 line 3284
[  416.213974] binder: BINDER_SET_CONTEXT_MGR already set
[  416.213983] binder: 17285:17290 ioctl 40046207 0 returned -16
[  416.214191] binder_alloc: 17258: binder_alloc_buf, no vma
[  416.214208] binder: 17285:17290 transaction failed 29189/-3, size 96-24 line 3284
[  416.223711] binder: BINDER_SET_CONTEXT_MGR already set
[  416.223719] binder: 17283:17291 ioctl 40046207 0 returned -16
[  416.274327] binder: BINDER_SET_CONTEXT_MGR already set
[  416.274335] binder: 17298:17299 ioctl 40046207 0 returned -16
[  416.276929] binder_alloc: 17258: binder_alloc_buf, no vma
[  416.276949] binder: 17298:17299 transaction failed 29189/-3, size 112-24 line 3284
[  416.289246] binder: BINDER_SET_CONTEXT_MGR already set
[  416.289255] binder: 17298:17299 ioctl 40046207 0 returned -16
[  416.289960] binder_alloc: 17259: binder_alloc_buf, no vma
[  416.289979] binder: 17297:17301 transaction failed 29189/-3, size 5703703374948466808-4496284358756266477 line 3284
[  416.508459] binder: undelivered TRANSACTION_ERROR: 29189
[  416.514080] binder: undelivered TRANSACTION_ERROR: 29189
[  416.519805] binder: undelivered TRANSACTION_ERROR: 29189
[  416.525541] binder: undelivered TRANSACTION_ERROR: 29189
[  416.531383] binder: undelivered TRANSACTION_ERROR: 29189
[  416.537286] binder: undelivered TRANSACTION_ERROR: 29189
[  416.542947] binder: undelivered TRANSACTION_ERROR: 29189
[  416.548589] binder: undelivered TRANSACTION_ERROR: 29201
03:16:57 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendto$inet6(r1, &(0x7f0000000100)="c715023590df989d9f7318", 0xb, 0x4000000, 0x0, 0x0)
r2 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:57 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x2, 0x1, 0x14}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0})

03:16:57 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000021000000000000001400000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})

03:16:57 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @remote}, 0x1c)
bind(r1, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x4, 0x0, 0x1, {0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x3f}}}, 0x80)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r3=>0xffffffffffffffff})
r4 = dup2(r3, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss], 0x12f8bc)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0xfd8e)
ptrace$setopts(0x4206, 0x0, 0x0, 0x0)
tkill(0x0, 0x1e)
wait4(0x0, 0x0, 0x0, 0x0)

03:16:57 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r1, 0x400454ce, r3)
mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0xffffffffffffffff)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r4 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x2ea, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0})

03:16:57 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
recvfrom(r0, &(0x7f0000000040)=""/24, 0x18, 0x3, &(0x7f0000000140)=@ethernet={0x6}, 0x80)
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x1000f4)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x10c000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r4, 0x0, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r4, 0x400454ce, r6)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000240)=0xc)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200000, 0x0)
read$char_usb(r8, 0x0, 0x0)
r9 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, <r10=>0x0}, &(0x7f0000000240)=0xc)
ioctl$TUNSETGROUP(r8, 0x400454ce, r10)
recvfrom(r8, &(0x7f0000000a80)=""/36, 0x24, 0x2, &(0x7f0000000ac0)=@isdn={0x22, 0x20, 0x1, 0x7f, 0x9a}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f00000001c0)={'team0\x00', <r11=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f00000009c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x88000180}, 0xc, &(0x7f0000000980)={&(0x7f0000000340)=@newchain={0x620, 0x64, 0x8, 0x70bd29, 0x3f, {0x0, 0x0, 0x0, r11, {0xe, 0xb}, {0xe, 0x5}, {0x1, 0x4834059bb9d4ec3c}}, [@TCA_RATE={0x8, 0x5, {0x81, 0x6}}, @TCA_CHAIN={0x8, 0xb, 0xff}, @TCA_RATE={0x8, 0x5, {0x6, 0x5}}, @filter_kind_options=@f_matchall={{0x10, 0x1, 'matchall\x00'}, {0x288, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4, 0xfbc1c4f82df0cdd}}, @TCA_MATCHALL_ACT={0x26c, 0x2, @m_ipt={0x268, 0x16, {{0x8, 0x1, 'ipt\x00'}, {0x15c, 0x2, [@TCA_IPT_TARG={0x88, 0x6, {0x200, 'mangle\x00', 0x6, 0x8aa, "591f5b76934895fde06ab81de42863813d158d93376cecc8868fe72e7058f4e773fea280a97137343af82112c45e8f89a54015a92f5c858eddb68bf3cd6f1e02eed2c0ea93ca57453c8e53cb0df26d355d917bf036c5455e760970c7b859"}}, @TCA_IPT_TARG={0xc8, 0x6, {0x72, 'mangle\x00', 0x5, 0x1f, "5495b889e5bbc27fb2ff10ec8f93fe1c33717e9325ddda251f8a37e91d39c5b55e4684e2c34108315e5f6864b8b6065931cca3b83b55de43a4e85122a276fb1832328b301c9691901dc59673a53fc7cbdbba008d56ce1ec0414dede71ac8a4f7fac9ff1a4a28f7332b844bc4503807d751cb6f28be807fa68ba198f383b6b830e9b05fcd8cde5b550ca39d1ef05d95593b0ea8a7ce9c9c0e92523500"}}, @TCA_IPT_HOOK={0x8}]}, {0xfc, 0x6, "4039432cb534073a00e005965371e1ef49c32009985130bedb806a07f29d0b54bd5bef06af3e7eecb9baa6e9500672709fe4fd4235eef01a8446ca5c3b8f69b8a414cf58bfe036f87fd11eacd4a4bc4141ccbb765ead267a5efdec157fd557e5ea97b7408fbee53f8a27fd60bbb1ca316f35675612c0983923a8d9cea44135fc34929b5255e0d3d5fb858f234f0737e13874cb92abf20083bb8d8ef6ca197dac731517fcf51370453984e2252904137f94e8f62065d394064f2949b624913280801f181321f15a81f7afe787df8440aed55e3f53ee989c2132ee1c12cdc18271cf91a90ee332c1eba2af5e51a532387103230b0db26e0fec"}}}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xe, 0x4}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}]}}, @TCA_CHAIN={0x8, 0xb, 0x3}, @filter_kind_options=@f_u32={{0x8, 0x1, 'u32\x00'}, {0xc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x7}]}}, @TCA_CHAIN={0x8, 0xb, 0x7}, @TCA_RATE={0x8, 0x5, {0x3f, 0x2}}, @TCA_RATE={0x8, 0x5, {0xfa, 0x4}}, @filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x308, 0x2, [@TCA_TCINDEX_ACT={0xcc, 0x7, @m_simple={0xc8, 0x10, {{0xc, 0x1, 'simple\x00'}, {0x2c, 0x2, [@TCA_DEF_DATA={0x10, 0x3, 'cgroup*\\\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x5d0, 0x3d3c6a461c984d06, 0x84, 0x7}}]}, {0x88, 0x6, "44cf13cd3e7565e127b7fe131ee2058d07572596ac8f8ed4ff5379cf29a621edc64230e3219e403efd2696ebd40372aa5a068f21692511f60f342848133ad6b35b012b5f7e79bebd9c654faa75d364e38096e22766e9960fc6a55dfa3e32ac29449f30759ce525092371176770b14e0000d9e8f576449a653bac2470edb2cc84e38d"}}}}, @TCA_TCINDEX_CLASSID={0x8, 0x5, {0xffeb, 0x17}}, @TCA_TCINDEX_ACT={0xa8, 0x7, @m_ctinfo={0xa4, 0x1, {{0xc, 0x1, 'ctinfo\x00'}, {0x1c, 0x2, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x8000}}, {0x74, 0x6, "a9c8dcc1552130b137ab492ac3d4bacf3317eae876d8fffd45f825dbaa63ea91cdaa6f1816c53f619762a51b5725ec4e12ec9c8e4bf8ffd94e6387c3553c230b2482eee08e3cfe75fd1d45e8d6810cb441490dd220114d2282d23bf846781323d18e0adc1a6d9761ddb7c65b817fc9"}}}}, @TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_POLICE={0x40, 0x6, @TCA_POLICE_TBF={0x3c, 0x1, {0x80, 0x6, 0x3, 0x6, 0x2, {0x80, 0x1, 0x1f, 0x3f, 0xa0, 0x8}, {0x6, 0x1, 0x7f, 0x7, 0x5}, 0x4, 0x661e53e4, 0x9}}}, @TCA_TCINDEX_MASK={0x8, 0x2, 0x7}, @TCA_TCINDEX_ACT={0x138, 0x7, @m_ctinfo={0x134, 0x18, {{0xc, 0x1, 'ctinfo\x00'}, {0x1c, 0x2, @TCA_CTINFO_ZONE={0x8}}, {0x104, 0x6, "c52eaa8121895d8247047891f0f309be0eda4fc94af3cc02cf884dcc29a9e1c17d5b37ecad9e5f9a5b8c4d2009ebf8c0eb33f8cb3633727dcc3fa74350f3acc84a4ab6192f12f51d1e4c17f571d69d61cacfa4c6ae1423e98355a977ece68b97dc4239f01fe2de5084193872d40918150cd68ae50c4af4ed0c3a845fa99419085de36acf3b766ea695171fa284b0891d2c6bd6a0a85c50c9dd5ca2bf4513ff789bc9795564e551503d0280116ca72ce6eb89c3c373f62cc01c405a7c1fe6bd286a55710cccc455ad51f305e21b2dd88211ac840e0cd84bb0d204d186d17a0199d75a3db47e13e9c7eeb7923934bda2fbf98d7f52401436d44228c0d77d34"}}}}]}}]}, 0x620}, 0x1, 0x0, 0x0, 0x4000088}, 0x80)
sendfile(r3, r2, 0x0, 0x8000fffffffe)
r12 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000a00)='/selinux/mls\x00', 0x0, 0x0)
ioctl$BLKRAGET(r12, 0x1263, &(0x7f0000000a40))

[  416.554299] binder: undelivered TRANSACTION_ERROR: 29201
[  416.560035] binder: undelivered TRANSACTION_ERROR: 29189
[  416.595192] ------------[ cut here ]------------
[  416.599976] kernel BUG at drivers/android/binder_alloc.c:1108!
[  416.605954] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[  416.607712] binder: 17313:17318 not enough space to store 0 fds in buffer
[  416.607733] binder: 17313:17318 transaction failed 29201/-22, size 120-24 line 3475
[  416.607859] binder: undelivered TRANSACTION_ERROR: 29201
[  416.608510] binder: 17313:17320 not enough space to store 0 fds in buffer
[  416.608532] binder: 17313:17320 transaction failed 29201/-22, size 120-24 line 3475
[  416.608776] binder: undelivered TRANSACTION_ERROR: 29201
[  416.651977] Modules linked in:
[  416.655296] CPU: 0 PID: 17316 Comm: syz-executor.5 Not tainted 4.9.194+ #0
[  416.662380] task: 00000000abc21682 task.stack: 000000006791cca4
[  416.668513] RIP: 0010:[<ffffffff8223a8fb>]  [<00000000cf535058>] binder_alloc_do_buffer_copy+0xcb/0x500
[  416.678237] RSP: 0018:ffff8801acba74a8  EFLAGS: 00010216
[  416.683794] RAX: 0000000000040000 RBX: 0000000020ffc000 RCX: ffffc90000f4a000
[  416.691087] RDX: 00000000000003a1 RSI: ffffffff8223a8fb RDI: ffff8801cca642d8
[  416.698520] RBP: ffff8801acba7528 R08: ffff8801acba75a8 R09: 0000000000000008
[  416.705781] R10: ffffed0035974f12 R11: ffff8801acba7897 R12: 0000000000000088
[  416.713037] R13: 0000000000000180 R14: 0000000000000008 R15: ffff8801acba75a8
[  416.720295] FS:  00007f7527296700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
[  416.728507] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  416.734384] CR2: 0000001b2e322000 CR3: 00000001ca536000 CR4: 00000000001606b0
[  416.741648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  416.748906] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  416.756163] Stack:
[  416.758302]  ffffffff81249811 ffff8801acba7568 0000000000000246 00000000200000c0
[  416.766401]  ffff88019cb28050 ffff8801cca643d8 00ff8801acba7870 ffff8801cca64380
[  416.774476]  ffffffff814fdcb6 ffff8801d6ede600 0000000000000180 ffff8801acba75a8
[  416.782533] Call Trace:
[  416.785119]  [<00000000e4252fda>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[  416.791876]  [<00000000c343789f>] ? memcpy+0x46/0x50
[  416.797033]  [<0000000073cf939e>] binder_alloc_copy_from_buffer+0x37/0x42
[  416.803951]  [<000000003992db6e>] binder_validate_ptr+0xc5/0x1b0
[  416.810086]  [<000000009fba1e67>] ? binder_get_object+0x1b0/0x1b0
[  416.816308]  [<0000000073cf939e>] ? binder_alloc_copy_from_buffer+0x37/0x42
[  416.823474]  [<00000000ad6cfaf8>] ? binder_get_object+0x12f/0x1b0
[  416.829893]  [<00000000c3df10aa>] binder_transaction+0x20a4/0x5890
[  416.836204]  [<000000007d9a69b0>] ? binder_inc_ref_for_node+0xba0/0xba0
[  416.842973]  [<00000000761b38dd>] ? __save_stack_trace+0x7a/0xf0
[  416.849255]  [<000000004da8c4db>] ? depot_save_stack+0x13c/0x4a0
[  416.855396]  [<00000000e4252fda>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[  416.862151]  [<000000007dbbf870>] ? __might_fault+0x114/0x1d0
[  416.868026]  [<00000000a239014a>] binder_thread_write+0x730/0x20e0
[  416.874334]  [<00000000ecd40b61>] ? trace_hardirqs_on+0x10/0x10
[  416.880573]  [<000000008c3be777>] ? _raw_spin_unlock_irqrestore+0x6b/0x70
[  416.887752]  [<00000000ce8f1d49>] ? binder_transaction+0x5890/0x5890
[  416.894328]  [<00000000e4252fda>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[  416.901082]  [<00000000f6632059>] binder_ioctl+0xecd/0x1720
[  416.906782]  [<00000000e4252fda>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[  416.913525]  [<0000000077642d05>] ? binder_poll+0x240/0x240
[  416.919304]  [<000000007dd41337>] ? __lock_acquire+0x5e0/0x4390
[  416.925354]  [<000000002bb1b8b3>] ? __might_sleep+0x95/0x1a0
[  416.931311]  [<0000000077642d05>] ? binder_poll+0x240/0x240
[  416.937014]  [<0000000097f36360>] do_vfs_ioctl+0xb87/0x11d0
[  416.942830]  [<000000002586e476>] ? selinux_file_ioctl+0x103/0x550
[  416.949407]  [<00000000b0fad5b3>] ? ioctl_preallocate+0x210/0x210
[  416.955761]  [<00000000d3e02e09>] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0
[  416.963286]  [<00000000649301bd>] ? __fget+0x208/0x370
[  416.968562]  [<000000006ef097d2>] ? __fget+0x22f/0x370
[  416.973835]  [<00000000be8ed745>] ? __fget+0x47/0x370
[  416.979023]  [<00000000f421a9ff>] ? security_file_ioctl+0x8f/0xc0
[  416.985331]  [<00000000cb707045>] SyS_ioctl+0x8f/0xc0
[  416.990515]  [<00000000112421db>] ? do_vfs_ioctl+0x11d0/0x11d0
[  416.996629]  [<0000000018ac36a6>] do_syscall_64+0x1ad/0x5c0
[  417.002332]  [<00000000e04fedc5>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
03:16:57 executing program 3:

[  417.009330] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 0f 7e 0e ff 4d 39 e6 76 07 e8 05 7e 0e ff <0f> 0b e8 fe 7d 0e ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 ed 
[  417.037973] RIP  [<00000000cf535058>] binder_alloc_do_buffer_copy+0xcb/0x500
[  417.045295]  RSP <ffff8801acba74a8>
[  417.051279] ---[ end trace 4c9a0532fc1663a6 ]---
03:16:57 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0)
syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xcb, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000078000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYRES64], @ANYBLOB="0000000000000000b98c1ecd6f3ee556bf0a458f8610171b25f6d17eccd593a697f978fb98f244658d497126e9404890b96dfce4cbcb47e2b9010a4eb8d1b4fbef4900bd4d9ed7ef797ea941979b407ada273f128dfb41b59b28fc325c90000000009b1a1282672f15aa5a7b39457c2c43c6fb3ec9c7cbdee5ce6ad9ab8c0a22b8f8bf2ae4b640"], 0x0, 0x0, 0x0})

[  417.056756] Kernel panic - not syncing: Fatal exception
[  417.059139] binder: 17315:17321 unknown command 0
[  417.059146] binder: 17315:17321 ioctl c0306201 20000180 returned -22
[  417.074178] Kernel Offset: disabled
[  417.077802] Rebooting in 86400 seconds..