rned -14 [ 229.372406] binder: undelivered TRANSACTION_ERROR: 29201 [ 229.732344] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.738789] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.746644] device bridge_slave_0 entered promiscuous mode [ 229.774093] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.780490] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.787703] device bridge_slave_1 entered promiscuous mode [ 229.814628] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 229.842435] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 229.919660] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 229.950413] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 230.070861] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 230.078140] team0: Port device team_slave_0 added [ 230.118669] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 230.125945] team0: Port device team_slave_1 added [ 230.151427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 230.178761] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 230.208814] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 230.216669] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 230.224929] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 230.251417] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 230.258530] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 230.266919] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 230.493820] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.500253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.506935] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.513309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.345314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 231.426691] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 231.507331] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 231.513542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 231.520841] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 231.597680] 8021q: adding VLAN 0 to HW filter on device team0 03:34:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:18 executing program 0: socket$inet6(0xa, 0x0, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:18 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:34:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) 03:34:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 233.053808] binder: 14700:14702 ERROR: BC_REGISTER_LOOPER called without request [ 233.069436] binder: send failed reply for transaction 45 to 14700:14702 [ 233.073121] binder: BINDER_SET_CONTEXT_MGR already set [ 233.079171] binder: 14700:14702 ioctl c0306201 2000efd0 returned -14 [ 233.088463] binder: BINDER_SET_CONTEXT_MGR already set [ 233.094841] binder: 14701:14707 ioctl 40046207 0 returned -16 03:34:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) 03:34:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:18 executing program 6: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 233.098938] binder: 14703:14704 ioctl 40046207 0 returned -16 [ 233.115933] binder: 14703:14704 ERROR: BC_REGISTER_LOOPER called without request [ 233.135808] binder: release 14701:14707 transaction 46 out, still active [ 233.142835] binder: undelivered TRANSACTION_COMPLETE 03:34:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x10, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) [ 233.179471] binder: undelivered TRANSACTION_COMPLETE [ 233.184730] binder: undelivered TRANSACTION_ERROR: 29201 [ 233.202895] binder: send failed reply for transaction 46, target dead 03:34:18 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) [ 233.227987] binder: 14719:14720 ERROR: BC_REGISTER_LOOPER called without request [ 233.363440] device bridge_slave_1 left promiscuous mode [ 233.369183] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.372377] IPVS: ftp: loaded support on port[0] = 21 [ 233.384614] device bridge_slave_0 left promiscuous mode [ 233.390244] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.426880] team0 (unregistering): Port device team_slave_1 removed [ 233.442653] team0 (unregistering): Port device team_slave_0 removed [ 233.453891] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 233.469119] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 233.499582] bond0 (unregistering): Released all slaves [ 234.251153] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.257583] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.265046] device bridge_slave_0 entered promiscuous mode [ 234.304108] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.310644] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.318111] device bridge_slave_1 entered promiscuous mode [ 234.354299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 234.390797] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 234.506293] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 234.546870] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 234.718093] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 234.727870] team0: Port device team_slave_0 added [ 234.763596] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 234.771011] team0: Port device team_slave_1 added [ 234.805514] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 234.844776] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 234.884252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 234.915702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 235.172734] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.179128] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.185782] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.192408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.200192] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 236.013862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 236.093321] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 236.172754] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 236.179059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 236.187301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 236.194819] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 236.268122] 8021q: adding VLAN 0 to HW filter on device team0 03:34:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x10, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) 03:34:23 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:23 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:34:23 executing program 6: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:23 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x10, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) [ 237.734327] binder: BINDER_SET_CONTEXT_MGR already set [ 237.735120] binder: 14994:14997 ERROR: BC_REGISTER_LOOPER called without request [ 237.745609] binder: 14999:15008 ioctl 40046207 0 returned -16 [ 237.747876] binder: BINDER_SET_CONTEXT_MGR already set [ 237.755388] binder: 14999:15008 ERROR: BC_REGISTER_LOOPER called without request [ 237.770618] binder: 15002:15003 ioctl 40046207 0 returned -16 03:34:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:23 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 237.786867] binder: send failed reply for transaction 49 to 15002:15003 [ 237.801020] binder: 14994:14997 ioctl c0306201 2000efd0 returned -14 [ 237.809364] binder: undelivered TRANSACTION_COMPLETE [ 237.814656] binder: undelivered TRANSACTION_ERROR: 29201 03:34:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {r2, 0x0, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) 03:34:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:23 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) [ 237.906165] binder: 15017:15018 ERROR: BC_REGISTER_LOOPER called without request 03:34:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {r2, 0x0, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) [ 238.017218] device bridge_slave_1 left promiscuous mode [ 238.022829] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.050979] device bridge_slave_0 left promiscuous mode [ 238.056660] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.081652] IPVS: ftp: loaded support on port[0] = 21 [ 238.112118] team0 (unregistering): Port device team_slave_1 removed [ 238.123747] team0 (unregistering): Port device team_slave_0 removed [ 238.133850] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 238.153607] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 238.187102] bond0 (unregistering): Released all slaves [ 238.949564] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.955986] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.963469] device bridge_slave_0 entered promiscuous mode [ 239.000994] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.007437] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.014918] device bridge_slave_1 entered promiscuous mode [ 239.052122] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 239.089149] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 239.197431] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 239.236744] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 239.409132] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 239.416731] team0: Port device team_slave_0 added [ 239.452615] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 239.460235] team0: Port device team_slave_1 added [ 239.494193] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 239.531307] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 239.571784] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 239.604010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 239.864917] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.871311] bridge0: port 2(bridge_slave_1) entered forwarding state [ 239.877985] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.884408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.891692] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 240.713506] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.794545] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 240.863202] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 240.877877] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 240.884118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 240.891386] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 240.969677] 8021q: adding VLAN 0 to HW filter on device team0 03:34:27 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)={0xffffffff}, 0x2}}, 0x20) write$rdma_cm(r1, &(0x7f0000000040)=@bind={0x14, 0x88, 0xfa00, {r2, 0x0, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}}, 0x90) 03:34:27 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:34:27 executing program 6: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:27 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:27 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 242.424208] binder: BINDER_SET_CONTEXT_MGR already set [ 242.429879] binder: BINDER_SET_CONTEXT_MGR already set [ 242.434918] binder: 15303:15310 ERROR: BC_REGISTER_LOOPER called without request [ 242.442194] binder: 15305:15308 ioctl 40046207 0 returned -16 [ 242.455919] binder: 15306:15309 ioctl 40046207 0 returned -16 03:34:28 executing program 3: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 242.468545] binder: 15305:15308 ERROR: BC_REGISTER_LOOPER called without request [ 242.477760] binder: 15306:15309 ERROR: BC_REGISTER_LOOPER called without request 03:34:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 242.516491] binder: BINDER_SET_CONTEXT_MGR already set [ 242.528600] binder: 15318:15319 ioctl 40046207 0 returned -16 [ 242.534839] binder: send failed reply for transaction 52 to 15306:15309 [ 242.542627] binder: 15303:15310 ioctl c0306201 2000efd0 returned -14 03:34:28 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 242.573296] binder: 15318:15319 ERROR: BC_REGISTER_LOOPER called without request [ 242.573945] binder: undelivered TRANSACTION_COMPLETE [ 242.586245] binder: undelivered TRANSACTION_ERROR: 29201 03:34:28 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") recvmsg(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(0xffffffffffffffff, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(0xffffffffffffffff) [ 242.678459] binder: 15327:15329 ERROR: BC_REGISTER_LOOPER called without request 03:34:28 executing program 4: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) 03:34:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 242.784342] device bridge_slave_1 left promiscuous mode [ 242.789977] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.812060] IPVS: ftp: loaded support on port[0] = 21 [ 242.833997] device bridge_slave_0 left promiscuous mode [ 242.839588] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.877909] team0 (unregistering): Port device team_slave_1 removed [ 242.890434] team0 (unregistering): Port device team_slave_0 removed [ 242.900875] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 242.917488] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 242.949160] bond0 (unregistering): Released all slaves 03:34:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:28 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 243.291365] binder: BINDER_SET_CONTEXT_MGR already set [ 243.301769] binder: BINDER_SET_CONTEXT_MGR already set [ 243.312721] binder: 15364:15365 ioctl 40046207 0 returned -16 03:34:28 executing program 3: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:28 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 243.337704] binder: 15364:15365 ERROR: BC_REGISTER_LOOPER called without request [ 243.339286] binder: 15363:15367 ioctl 40046207 0 returned -16 [ 243.351079] binder: send failed reply for transaction 54 to 15364:15365 [ 243.377628] binder: 15327:15329 ioctl c0306201 2000efd0 returned -14 03:34:29 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 243.389176] binder: undelivered TRANSACTION_COMPLETE [ 243.394422] binder: undelivered TRANSACTION_ERROR: 29201 [ 243.405083] binder: BINDER_SET_CONTEXT_MGR already set 03:34:29 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 243.434455] binder: 15372:15373 ioctl 40046207 0 returned -16 [ 243.470181] binder: send failed reply for transaction 55 to 15363:15367 [ 243.491422] binder: 15372:15373 ERROR: BC_REGISTER_LOOPER called without request [ 243.517227] binder: 15380:15382 ERROR: BC_REGISTER_LOOPER called without request 03:34:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:29 executing program 4: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) 03:34:29 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 243.949320] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.955897] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.964404] device bridge_slave_0 entered promiscuous mode [ 244.010932] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.017435] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.024820] device bridge_slave_1 entered promiscuous mode [ 244.068607] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 244.121859] binder: undelivered TRANSACTION_COMPLETE [ 244.127173] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.161163] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 244.323521] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 244.387972] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 244.592313] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 244.599707] team0: Port device team_slave_0 added [ 244.635761] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 244.643173] team0: Port device team_slave_1 added [ 244.678369] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 244.685304] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 244.696349] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 244.721721] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 244.728643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 244.736993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 244.773893] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 244.781132] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 244.796383] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 244.824995] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 244.832200] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 244.840241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 245.100190] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.106601] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.113251] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.119625] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.127280] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 245.599597] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 245.976507] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.061182] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 246.142748] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 246.148981] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 246.156192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 246.235636] 8021q: adding VLAN 0 to HW filter on device team0 03:34:33 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:33 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:33 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:33 executing program 3: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:33 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:33 executing program 4: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) [ 247.723881] binder: 15653:15654 ERROR: BC_REGISTER_LOOPER called without request [ 247.730297] binder: BINDER_SET_CONTEXT_MGR already set [ 247.736882] binder: BINDER_SET_CONTEXT_MGR already set [ 247.740827] binder: 15648:15649 ioctl 40046207 0 returned -16 [ 247.742233] binder: BINDER_SET_CONTEXT_MGR already set [ 247.742259] binder: 15656:15658 ioctl 40046207 0 returned -16 [ 247.760072] binder: 15650:15652 ioctl 40046207 0 returned -16 [ 247.766682] binder: 15648:15649 ERROR: BC_REGISTER_LOOPER called without request 03:34:33 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 247.768262] binder: send failed reply for transaction 58 to 15650:15652 [ 247.782800] binder: 15653:15654 ioctl c0306201 2000efd0 returned -14 [ 247.783307] binder: 15656:15658 ERROR: BC_REGISTER_LOOPER called without request [ 247.798739] binder: release 15656:15658 transaction 59 out, still active [ 247.805751] binder: undelivered TRANSACTION_COMPLETE [ 247.814855] binder: send failed reply for transaction 59, target dead 03:34:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x0, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 247.857898] binder: 15662:15665 ERROR: BC_REGISTER_LOOPER called without request [ 247.987429] device bridge_slave_1 left promiscuous mode [ 247.993147] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.005949] device bridge_slave_0 left promiscuous mode [ 248.011601] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.053377] team0 (unregistering): Port device team_slave_1 removed [ 248.063875] team0 (unregistering): Port device team_slave_0 removed [ 248.075141] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 248.092633] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 248.124385] bond0 (unregistering): Released all slaves [ 248.574848] binder: undelivered TRANSACTION_COMPLETE [ 248.580124] binder: undelivered TRANSACTION_ERROR: 29201 03:34:34 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x53, 0x0, 0x6, 0x0, @buffer={0xd, 0x4, &(0x7f0000000040)=""/4}, &(0x7f0000000180)="3c1a016b527d", &(0x7f0000000240)=""/41, 0x0, 0x0, 0x0, &(0x7f0000000280)}) 03:34:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:34 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:34 executing program 4: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) 03:34:34 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 248.877938] binder: 15678:15679 ERROR: BC_REGISTER_LOOPER called without request [ 248.878242] binder: BINDER_SET_CONTEXT_MGR already set 03:34:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000200), 0x2) 03:34:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 248.930232] binder: release 15678:15679 transaction 62 out, still active [ 248.937037] binder: 15685:15687 ioctl 40046207 0 returned -16 [ 248.937334] binder: undelivered TRANSACTION_COMPLETE 03:34:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=@ipv6_newroute={0x20, 0x18, 0xb03, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_METRICS={0x4, 0x8}]}, 0x20}, 0x1}, 0x0) 03:34:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 249.071683] IPVS: ftp: loaded support on port[0] = 21 [ 249.104280] IPv6: NLM_F_REPLACE set, but no existing node found! [ 249.704924] binder: release 15685:15687 transaction 63 out, still active [ 249.711933] binder: undelivered TRANSACTION_COMPLETE [ 249.718129] binder: send failed reply for transaction 62, target dead [ 249.724897] binder: send failed reply for transaction 63, target dead [ 249.798423] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.804835] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.811928] device bridge_slave_0 entered promiscuous mode [ 249.837401] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.843798] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.850923] device bridge_slave_1 entered promiscuous mode [ 249.875366] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 249.900680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 249.969582] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 249.998197] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 250.106235] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 250.113579] team0: Port device team_slave_0 added [ 250.137489] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 250.144628] team0: Port device team_slave_1 added [ 250.168742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 250.195421] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 250.221113] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 250.228283] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 250.236516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 250.257187] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 250.264297] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 250.272544] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 250.498330] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.504748] bridge0: port 2(bridge_slave_1) entered forwarding state [ 250.511422] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.517804] bridge0: port 1(bridge_slave_0) entered forwarding state [ 250.525115] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 250.912207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 251.361628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.443168] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 251.524396] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 251.530632] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 251.538131] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 251.615784] 8021q: adding VLAN 0 to HW filter on device team0 03:34:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:38 executing program 3: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r0}], 0x1, 0x0) 03:34:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:38 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:38 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:38 executing program 4: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) [ 253.091632] binder: 15977:15983 ERROR: BC_REGISTER_LOOPER called without request [ 253.101091] binder: BINDER_SET_CONTEXT_MGR already set [ 253.110826] binder: 15982:15988 ERROR: BC_REGISTER_LOOPER called without request [ 253.122370] binder: 15980:15985 ioctl 40046207 0 returned -16 [ 253.135180] binder_alloc: 15977: binder_alloc_buf, no vma 03:34:38 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r0, 0x6, 0x1f, &(0x7f0000000240)=""/177, &(0x7f0000000000)=0xfffffffffffffd7b) 03:34:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 253.141195] binder: 15982:15988 transaction failed 29189/-3, size 0-0 line 2967 [ 253.154112] binder_alloc: 15977: binder_alloc_buf, no vma [ 253.159830] binder: 15977:15983 transaction failed 29189/-3, size 0-0 line 2967 [ 253.176684] binder: undelivered TRANSACTION_ERROR: 29189 03:34:38 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:38 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000e000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000002000ffff0000000000000000000000b580a897226206203c40f6c8622e00"], 0x1}, 0x1}, 0x0) [ 253.366603] device bridge_slave_1 left promiscuous mode [ 253.372311] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.394571] device bridge_slave_0 left promiscuous mode [ 253.400265] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.461167] IPVS: ftp: loaded support on port[0] = 21 [ 253.471822] team0 (unregistering): Port device team_slave_1 removed [ 253.490226] team0 (unregistering): Port device team_slave_0 removed [ 253.502939] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 253.518281] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 253.547072] bond0 (unregistering): Released all slaves [ 253.906579] binder: undelivered TRANSACTION_ERROR: 29189 [ 254.264369] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.271118] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.278692] device bridge_slave_0 entered promiscuous mode [ 254.317376] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.323820] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.331319] device bridge_slave_1 entered promiscuous mode [ 254.368145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 254.405794] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 254.516758] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 254.557563] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 254.733362] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 254.740578] team0: Port device team_slave_0 added [ 254.768617] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 254.775768] team0: Port device team_slave_1 added [ 254.811862] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 254.852315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 254.881718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 254.921448] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 255.176744] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.183193] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.189895] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.196278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.038630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.120011] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 256.200909] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 256.207137] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 256.214677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 256.290749] 8021q: adding VLAN 0 to HW filter on device team0 03:34:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x0, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:43 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) request_key(&(0x7f00000001c0)='\b\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)='trustedcgroup+\x00', 0xffffffffffffffff) write$rdma_cm(r0, &(0x7f0000001bc0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001b80)}}, 0x20) 03:34:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:43 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:43 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:43 executing program 4: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r0, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r1, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r0) 03:34:43 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 257.755062] binder: 16282:16284 ERROR: BC_REGISTER_LOOPER called without request [ 257.764256] binder: BINDER_SET_CONTEXT_MGR already set [ 257.769820] binder: 16278:16287 ioctl 40046207 0 returned -16 [ 257.777367] binder: release 16282:16284 transaction 68 out, still active [ 257.784354] binder: undelivered TRANSACTION_COMPLETE [ 257.793237] binder: 16278:16287 ERROR: BC_REGISTER_LOOPER called without request 03:34:43 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:43 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:43 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 258.044213] device bridge_slave_1 left promiscuous mode [ 258.049841] bridge0: port 2(bridge_slave_1) entered disabled state [ 258.081731] device bridge_slave_0 left promiscuous mode [ 258.087384] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.130748] IPVS: ftp: loaded support on port[0] = 21 [ 258.164236] team0 (unregistering): Port device team_slave_1 removed [ 258.176073] team0 (unregistering): Port device team_slave_0 removed [ 258.188615] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 258.207650] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 258.237064] bond0 (unregistering): Released all slaves [ 258.558774] binder: send failed reply for transaction 68, target dead [ 258.565497] binder: send failed reply for transaction 69 to 16278:16287 [ 258.614276] binder: undelivered TRANSACTION_COMPLETE [ 258.619501] binder: undelivered TRANSACTION_ERROR: 29189 [ 259.012319] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.018774] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.027435] device bridge_slave_0 entered promiscuous mode [ 259.065893] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.072341] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.080160] device bridge_slave_1 entered promiscuous mode [ 259.117055] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 259.155166] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 259.266617] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 259.307464] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 259.469553] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 259.476999] team0: Port device team_slave_0 added [ 259.513609] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 259.521186] team0: Port device team_slave_1 added [ 259.554806] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 259.593147] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 259.625159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 259.651696] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 259.882461] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.888875] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.895520] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.901912] bridge0: port 1(bridge_slave_0) entered forwarding state [ 259.909283] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 260.731140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 260.810921] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 260.890642] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 260.896893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 260.904709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 260.912786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 260.983915] 8021q: adding VLAN 0 to HW filter on device team0 03:34:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:48 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:48 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:48 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:48 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 262.453689] binder: 16588:16592 ERROR: BC_REGISTER_LOOPER called without request [ 262.462986] binder: BINDER_SET_CONTEXT_MGR already set [ 262.471322] binder_alloc: 16588: binder_alloc_buf, no vma [ 262.477011] binder_alloc: 16588: binder_alloc_buf, no vma [ 262.477072] binder: 16588:16592 transaction failed 29189/-3, size 0-0 line 2967 [ 262.482662] binder: 16590:16595 transaction failed 29189/-3, size 0-0 line 2967 03:34:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 262.508251] binder: 16586:16589 ioctl 40046207 0 returned -16 [ 262.544240] binder: 16586:16589 ERROR: BC_REGISTER_LOOPER called without request [ 262.545170] binder: undelivered TRANSACTION_ERROR: 29189 03:34:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:48 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 262.678065] binder_alloc: 16588: binder_alloc_buf, no vma [ 262.683926] binder: 16605:16606 transaction failed 29189/-3, size 0-0 line 2967 03:34:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440), 0x0, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 262.729708] device bridge_slave_1 left promiscuous mode [ 262.735922] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.781148] device bridge_slave_0 left promiscuous mode [ 262.786755] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.866342] IPVS: ftp: loaded support on port[0] = 21 [ 262.877206] team0 (unregistering): Port device team_slave_1 removed [ 262.887991] team0 (unregistering): Port device team_slave_0 removed [ 262.899975] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 262.919523] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 262.950738] bond0 (unregistering): Released all slaves [ 262.999652] binder: undelivered TRANSACTION_ERROR: 29189 [ 263.276582] binder: undelivered TRANSACTION_ERROR: 29189 [ 263.685405] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.691879] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.699307] device bridge_slave_0 entered promiscuous mode [ 263.736769] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.743247] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.750872] device bridge_slave_1 entered promiscuous mode [ 263.788043] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 263.825239] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 263.935142] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 263.975645] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 264.144718] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 264.152810] team0: Port device team_slave_0 added [ 264.189277] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 264.196792] team0: Port device team_slave_1 added [ 264.234619] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 264.262075] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 264.301263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 264.340333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 264.572833] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.579221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.585867] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.592235] bridge0: port 1(bridge_slave_0) entered forwarding state [ 265.426229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 265.508831] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 265.590137] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 265.596487] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 265.603989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 265.681978] 8021q: adding VLAN 0 to HW filter on device team0 03:34:52 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440), 0x0, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:52 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:52 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:52 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:52 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:34:52 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 267.142820] binder: 16887:16889 ERROR: BC_REGISTER_LOOPER called without request [ 267.157246] binder_alloc: 16887: binder_alloc_buf, no vma [ 267.162982] binder: 16886:16888 transaction failed 29189/-3, size 0-0 line 2967 [ 267.173081] binder: 16892:16893 ERROR: BC_REGISTER_LOOPER called without request [ 267.187006] binder_alloc: 16887: binder_alloc_buf, no vma 03:34:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 267.192848] binder: 16892:16893 transaction failed 29189/-3, size 0-0 line 2967 03:34:52 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 267.264801] binder: undelivered TRANSACTION_ERROR: 29189 [ 267.344225] binder: BINDER_SET_CONTEXT_MGR already set 03:34:52 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:52 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 267.368420] binder: 16910:16911 ioctl 40046207 0 returned -16 [ 267.399492] binder: 16910:16911 ERROR: BC_REGISTER_LOOPER called without request 03:34:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440), 0x0, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 267.435209] device bridge_slave_1 left promiscuous mode [ 267.441268] bridge0: port 2(bridge_slave_1) entered disabled state [ 267.482361] device bridge_slave_0 left promiscuous mode [ 267.488058] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.566643] team0 (unregistering): Port device team_slave_1 removed [ 267.583235] IPVS: ftp: loaded support on port[0] = 21 [ 267.590284] team0 (unregistering): Port device team_slave_0 removed [ 267.604974] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 267.621636] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 267.667945] bond0 (unregistering): Released all slaves [ 267.981576] binder: undelivered TRANSACTION_ERROR: 29189 [ 268.392710] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.399138] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.406419] device bridge_slave_0 entered promiscuous mode [ 268.444376] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.450819] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.458124] device bridge_slave_1 entered promiscuous mode [ 268.494668] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 268.531612] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 268.639751] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 268.679575] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 268.850127] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 268.857969] team0: Port device team_slave_0 added [ 268.890403] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 268.897801] team0: Port device team_slave_1 added [ 268.934304] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 268.974760] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 269.001305] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 269.039833] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 269.285618] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.292070] bridge0: port 2(bridge_slave_1) entered forwarding state [ 269.298689] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.305087] bridge0: port 1(bridge_slave_0) entered forwarding state [ 270.126814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 270.206680] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 270.288077] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 270.294281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.301472] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 270.377252] 8021q: adding VLAN 0 to HW filter on device team0 03:34:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:57 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:57 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000), 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:57 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:57 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:57 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:34:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 271.843771] binder: BINDER_SET_CONTEXT_MGR already set [ 271.849484] binder: 17193:17202 ERROR: BC_REGISTER_LOOPER called without request [ 271.851669] binder: 17195:17204 ERROR: BC_REGISTER_LOOPER called without request [ 271.860473] binder: 17192:17194 ioctl 40046207 0 returned -16 [ 271.885630] binder: 17192:17194 ERROR: BC_REGISTER_LOOPER called without request 03:34:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000), 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 271.898489] binder_alloc: 17193: binder_alloc_buf, no vma [ 271.904220] binder: 17195:17204 transaction failed 29189/-3, size 0-0 line 2967 03:34:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) 03:34:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000), 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:57 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:34:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) 03:34:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 272.127221] device bridge_slave_1 left promiscuous mode [ 272.132834] bridge0: port 2(bridge_slave_1) entered disabled state [ 272.157589] device bridge_slave_0 left promiscuous mode [ 272.163227] bridge0: port 1(bridge_slave_0) entered disabled state [ 272.173684] IPVS: ftp: loaded support on port[0] = 21 [ 272.207842] team0 (unregistering): Port device team_slave_1 removed [ 272.218203] team0 (unregistering): Port device team_slave_0 removed [ 272.230332] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 272.247630] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 272.280079] bond0 (unregistering): Released all slaves 03:34:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 272.692972] binder: undelivered TRANSACTION_ERROR: 29189 03:34:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:34:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) 03:34:58 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:58 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:58 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:58 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 272.869613] binder: 17264:17269 ERROR: BC_REGISTER_LOOPER called without request [ 272.872862] binder: 17261:17267 ERROR: BC_REGISTER_LOOPER called without request [ 272.892345] binder: 17271:17272 ERROR: BC_REGISTER_LOOPER called without request 03:34:58 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:34:58 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 272.919191] binder: send failed reply for transaction 80 to 17264:17269 [ 272.933406] binder: 17271:17272 ioctl c0306201 2000efd0 returned -14 03:34:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:34:58 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:34:58 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 273.092321] binder: 17289:17290 ERROR: BC_REGISTER_LOOPER called without request [ 273.135203] binder: 17289:17290 transaction failed 29189/-22, size 0-0 line 2852 [ 273.174565] binder: undelivered TRANSACTION_ERROR: 29189 [ 273.400371] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.406952] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.415075] device bridge_slave_0 entered promiscuous mode [ 273.464850] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.471423] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.479589] device bridge_slave_1 entered promiscuous mode [ 273.523936] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 273.573105] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 273.692265] binder: undelivered TRANSACTION_COMPLETE [ 273.697475] binder: undelivered TRANSACTION_ERROR: 29201 [ 273.721703] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 273.799187] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 274.018114] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 274.026606] team0: Port device team_slave_0 added [ 274.078220] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 274.085942] team0: Port device team_slave_1 added [ 274.121611] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 274.128569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 274.136657] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 274.165173] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 274.172168] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 274.180469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 274.220391] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 274.228404] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 274.236487] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 274.258681] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 274.265805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 274.273748] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 274.507457] bridge0: port 2(bridge_slave_1) entered blocking state [ 274.513855] bridge0: port 2(bridge_slave_1) entered forwarding state [ 274.520519] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.526894] bridge0: port 1(bridge_slave_0) entered forwarding state [ 274.534242] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 275.039139] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 275.366631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.450216] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 275.530325] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 275.536535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 275.544066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 275.621555] 8021q: adding VLAN 0 to HW filter on device team0 03:35:01 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x0, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) 03:35:01 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:01 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 276.141416] binder: 17549:17551 transaction failed 29189/-22, size 0-0 line 2852 [ 276.147223] binder: 17547:17555 ERROR: BC_REGISTER_LOOPER called without request [ 276.158924] binder: 17550:17554 ERROR: BC_REGISTER_LOOPER called without request [ 276.170168] binder: 17547:17555 transaction failed 29189/-22, size 0-0 line 2852 03:35:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:01 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 276.196662] binder: undelivered TRANSACTION_ERROR: 29189 [ 276.206152] binder: undelivered TRANSACTION_ERROR: 29189 03:35:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 276.257612] binder: 17565:17566 transaction failed 29189/-22, size 0-0 line 2852 [ 276.294513] binder: undelivered TRANSACTION_ERROR: 29189 03:35:02 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x0, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:02 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:02 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x0, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x2) [ 277.140063] binder: 17585:17593 ERROR: BC_REGISTER_LOOPER called without request [ 277.146293] binder: 17582:17596 transaction failed 29189/-22, size 0-0 line 2852 [ 277.149567] binder: 17583:17595 ERROR: BC_REGISTER_LOOPER called without request [ 277.201313] binder: 17585:17593 transaction failed 29189/-22, size 0-0 line 2852 [ 277.202191] binder: undelivered TRANSACTION_ERROR: 29189 [ 277.220993] binder: undelivered TRANSACTION_ERROR: 29189 [ 278.236345] device bridge_slave_1 left promiscuous mode [ 278.241926] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.252667] device bridge_slave_0 left promiscuous mode [ 278.258243] bridge0: port 1(bridge_slave_0) entered disabled state 03:35:03 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180), 0x0, 0x2) 03:35:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:03 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x0, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:03 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 278.290941] team0 (unregistering): Port device team_slave_1 removed [ 278.301054] team0 (unregistering): Port device team_slave_0 removed [ 278.312472] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 278.339228] bond0 (unregistering): Releasing backup interface bond_slave_0 03:35:03 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 278.368593] binder: 17615:17616 ERROR: BC_REGISTER_LOOPER called without request [ 278.383506] binder: BINDER_SET_CONTEXT_MGR already set [ 278.424997] binder: 17611:17624 ioctl 40046207 0 returned -16 [ 278.453748] bond0 (unregistering): Released all slaves [ 278.464947] binder: 17611:17624 ERROR: BC_REGISTER_LOOPER called without request 03:35:04 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:04 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180), 0x0, 0x2) [ 278.507475] binder: send failed reply for transaction 88 to 17611:17624 [ 278.514432] binder: undelivered TRANSACTION_COMPLETE [ 278.519658] binder: undelivered TRANSACTION_ERROR: 29201 [ 278.537588] binder: 17615:17616 ioctl c0306201 2000efd0 returned -14 03:35:04 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:04 executing program 1: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180), 0x0, 0x2) [ 278.714998] binder: 17643:17644 ERROR: BC_REGISTER_LOOPER called without request [ 279.988155] IPVS: ftp: loaded support on port[0] = 21 [ 280.341121] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.347515] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.354741] device bridge_slave_0 entered promiscuous mode [ 280.379986] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.386406] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.393952] device bridge_slave_1 entered promiscuous mode [ 280.419799] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 280.445594] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 280.517424] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 280.545143] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 280.653530] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 280.661276] team0: Port device team_slave_0 added [ 280.685835] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 280.692967] team0: Port device team_slave_1 added [ 280.717435] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 280.745333] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 280.771407] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 280.798661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 281.029150] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.035586] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.042262] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.048634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.883513] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.965931] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 282.046691] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 282.053091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 282.060233] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 282.136776] 8021q: adding VLAN 0 to HW filter on device team0 03:35:09 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{}], 0x1, 0x2) 03:35:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:09 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x0, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:09 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 283.611217] binder: BINDER_SET_CONTEXT_MGR already set [ 283.617254] binder: BINDER_SET_CONTEXT_MGR already set [ 283.619728] binder: 17920:17923 ERROR: BC_REGISTER_LOOPER called without request [ 283.629380] binder: 17929:17932 ioctl 40046207 0 returned -16 [ 283.636396] binder: 17927:17930 ioctl 40046207 0 returned -16 [ 283.645299] binder: 17927:17930 ERROR: BC_REGISTER_LOOPER called without request 03:35:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{}], 0x1, 0x2) [ 283.664278] binder: 17929:17932 ERROR: BC_REGISTER_LOOPER called without request [ 283.675611] binder: send failed reply for transaction 91 to 17927:17930 [ 283.684342] binder: 17920:17923 ioctl c0306201 2000efd0 returned -14 [ 283.698997] binder: undelivered TRANSACTION_COMPLETE [ 283.704222] binder: undelivered TRANSACTION_ERROR: 29201 03:35:09 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{}], 0x1, 0x2) 03:35:09 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(0xffffffffffffffff, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) [ 283.820866] binder: 17944:17946 ERROR: BC_REGISTER_LOOPER called without request 03:35:09 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 283.875685] device bridge_slave_1 left promiscuous mode [ 283.881362] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.893898] device bridge_slave_0 left promiscuous mode [ 283.899513] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.969843] team0 (unregistering): Port device team_slave_1 removed [ 283.983503] IPVS: ftp: loaded support on port[0] = 21 [ 283.984164] team0 (unregistering): Port device team_slave_0 removed [ 283.999360] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 284.016890] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 284.048606] bond0 (unregistering): Released all slaves [ 284.853610] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.860086] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.867486] device bridge_slave_0 entered promiscuous mode [ 284.904939] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.911371] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.919178] device bridge_slave_1 entered promiscuous mode [ 284.957722] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 284.995087] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 285.107766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 285.148416] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 285.319669] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 285.327735] team0: Port device team_slave_0 added [ 285.366856] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 285.374012] team0: Port device team_slave_1 added [ 285.398924] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 285.436753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 285.476949] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 285.504880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 285.739544] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.745973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 285.752646] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.759079] bridge0: port 1(bridge_slave_0) entered forwarding state [ 285.766324] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 286.593905] 8021q: adding VLAN 0 to HW filter on device bond0 [ 286.676088] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 286.751185] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 286.762978] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 286.769209] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 286.776748] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 286.854705] 8021q: adding VLAN 0 to HW filter on device team0 03:35:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x0) 03:35:13 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:13 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:13 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(0xffffffffffffffff, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x0, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:13 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 288.290811] binder: 18224:18226 ERROR: BC_REGISTER_LOOPER called without request [ 288.292229] binder: 18229:18230 ERROR: BC_REGISTER_LOOPER called without request [ 288.312089] binder: 18223:18236 ERROR: BC_REGISTER_LOOPER called without request [ 288.325264] binder_alloc: 18224: binder_alloc_buf, no vma [ 288.330967] binder: 18224:18226 transaction failed 29189/-3, size 0-0 line 2967 03:35:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x0) [ 288.340118] binder_alloc: 18224: binder_alloc_buf, no vma [ 288.345819] binder: 18229:18230 transaction failed 29189/-3, size 0-0 line 2967 [ 288.356915] binder: undelivered TRANSACTION_ERROR: 29189 03:35:13 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:14 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000788000)=0x20000000001, 0x4) setsockopt(r1, 0x107, 0x5, &(0x7f0000001000), 0xc5) poll(&(0x7f0000000180)=[{r1}], 0x1, 0x0) 03:35:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:14 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(0xffffffffffffffff, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:14 executing program 7: open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r0, &(0x7f0000000100)=""/143, 0xbd4c) 03:35:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 288.548766] device bridge_slave_1 left promiscuous mode [ 288.554497] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.587374] device bridge_slave_0 left promiscuous mode [ 288.593129] bridge0: port 1(bridge_slave_0) entered disabled state 03:35:14 executing program 7: [ 288.634795] IPVS: ftp: loaded support on port[0] = 21 03:35:14 executing program 7: [ 288.699965] team0 (unregistering): Port device team_slave_1 removed [ 288.716468] team0 (unregistering): Port device team_slave_0 removed [ 288.729594] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 288.747040] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 288.775368] bond0 (unregistering): Released all slaves 03:35:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:14 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 289.147897] binder: undelivered TRANSACTION_ERROR: 29189 03:35:14 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:14 executing program 7: [ 289.213856] binder: 18288:18289 ERROR: BC_REGISTER_LOOPER called without request [ 289.230305] binder: 18287:18291 ERROR: BC_REGISTER_LOOPER called without request 03:35:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x0, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:14 executing program 7: [ 289.264133] binder_alloc: 18287: binder_alloc_buf, no vma [ 289.269925] binder: 18288:18289 transaction failed 29189/-3, size 0-0 line 2967 [ 289.286532] binder_alloc: 18287: binder_alloc_buf, no vma [ 289.292232] binder: 18287:18291 transaction failed 29189/-3, size 0-0 line 2967 03:35:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 289.347171] binder: undelivered TRANSACTION_ERROR: 29189 [ 289.350580] binder: 18299:18301 ERROR: BC_REGISTER_LOOPER called without request 03:35:15 executing program 7: 03:35:15 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) [ 289.795105] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.801542] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.808862] device bridge_slave_0 entered promiscuous mode [ 289.846209] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.852638] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.860194] device bridge_slave_1 entered promiscuous mode [ 289.900784] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 289.941109] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 290.037239] binder: undelivered TRANSACTION_ERROR: 29189 [ 290.107708] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 290.193176] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 290.390225] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 290.397564] team0: Port device team_slave_0 added [ 290.442736] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 290.450294] team0: Port device team_slave_1 added [ 290.486082] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 290.493080] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 290.508509] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 290.538355] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 290.545259] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 290.553176] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 290.586439] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 290.593656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 290.602472] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 290.640991] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 290.648448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 290.656560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 290.887279] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.893701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 290.900377] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.906757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 290.913985] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 291.487392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 291.749699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.831466] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 291.912963] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 291.919200] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 291.926312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 292.002355] 8021q: adding VLAN 0 to HW filter on device team0 03:35:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:19 executing program 7: 03:35:19 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000000c0)) 03:35:19 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:19 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:19 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@abs, 0x6e) 03:35:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x0, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:19 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) 03:35:19 executing program 7: [ 293.438928] binder: 18568:18570 ERROR: BC_REGISTER_LOOPER called without request [ 293.453055] binder: BINDER_SET_CONTEXT_MGR already set [ 293.455794] binder: 18572:18576 ERROR: BC_REGISTER_LOOPER called without request [ 293.475648] binder: 18571:18574 ioctl 40046207 0 returned -16 [ 293.486549] binder_alloc: 18568: binder_alloc_buf, no vma [ 293.492277] binder: 18572:18576 transaction failed 29189/-3, size 0-0 line 2967 [ 293.509388] binder: 18571:18574 ERROR: BC_REGISTER_LOOPER called without request 03:35:19 executing program 7: 03:35:19 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) [ 293.543849] binder_alloc: 18568: binder_alloc_buf, no vma [ 293.549582] binder: 18571:18574 transaction failed 29189/-3, size 0-0 line 2967 [ 293.568487] binder: undelivered TRANSACTION_ERROR: 29189 03:35:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x10, 0x802, 0x0) write(r1, &(0x7f0000000240)="fc0000001a000700ab092500090007000aab80ff0100000000003693210001004e3d951e6a5914fe6a61783b6f2614d8ff010000000500000000000000036915fa2c1ec28656aaa79bb94b46fe0000000700020800008c0000036c6c256f1a272f2e117c35ebc205214000000000008934d07302ade01720d7d5bbc91a3e2e80772c74fb2cc56ce1f0f156272f5b00000005defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bbab2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad7cf81eeee5cc68eade445e0a4f01731d05b0350b0041f0", 0xfc) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) 03:35:19 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@abs, 0x6e) 03:35:19 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0bc5310, &(0x7f00000000c0)) [ 293.696100] netlink: 188 bytes leftover after parsing attributes in process `syz-executor7'. [ 293.719459] device bridge_slave_1 left promiscuous mode [ 293.725171] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.730292] netlink: 188 bytes leftover after parsing attributes in process `syz-executor7'. [ 293.753620] device bridge_slave_0 left promiscuous mode [ 293.759292] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.777714] IPVS: ftp: loaded support on port[0] = 21 [ 293.812005] team0 (unregistering): Port device team_slave_1 removed [ 293.825012] team0 (unregistering): Port device team_slave_0 removed [ 293.835407] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 293.851474] bond0 (unregistering): Releasing backup interface bond_slave_0 03:35:19 executing program 7: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000004c0)=""/148, 0x1bf}], 0x1b6, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_adj\x00') preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000280)=""/209}, {&(0x7f0000000380)=""/242}], 0x10000000000002a1, 0x0) [ 293.880284] bond0 (unregistering): Released all slaves [ 294.295392] binder: undelivered TRANSACTION_ERROR: 29189 [ 294.680916] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.687486] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.696179] device bridge_slave_0 entered promiscuous mode [ 294.736923] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.743344] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.751183] device bridge_slave_1 entered promiscuous mode [ 294.789071] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 294.827600] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 294.938334] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 294.979285] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 295.150695] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 295.159229] team0: Port device team_slave_0 added [ 295.196823] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 295.204675] team0: Port device team_slave_1 added [ 295.241368] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 295.279163] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 295.320559] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 295.349219] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 295.581216] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.587608] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.594251] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.600630] bridge0: port 1(bridge_slave_0) entered forwarding state [ 295.607899] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 296.429681] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.509642] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 296.589761] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 296.595981] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 296.603712] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 296.611799] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 296.682751] 8021q: adding VLAN 0 to HW filter on device team0 03:35:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:23 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000280)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001800190d00000000000000000a00000000000006000000002002b163eec150ead4ce58fb56e10fcc9e895ba9d38369aaecac1c46c52c0065df61ac2e34f381d086969d244733198532ff062c295069949f1d6c5e00c78cd8167395949715954eeccfbbe39ba843156b43134bddaaabfcbabfe29073c8d36607c0635a9c600b31b1697f36bc659ff7ff2b4816ca2d8e7976826b6a7b9f13bee72eb7a281"], 0x1}, 0x1}, 0x0) 03:35:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:23 executing program 0: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x1000000, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@abs, 0x6e) 03:35:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x0, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:23 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:23 executing program 3: 03:35:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 298.136196] binder: BINDER_SET_CONTEXT_MGR already set [ 298.137061] binder: 18877:18882 ERROR: BC_REGISTER_LOOPER called without request [ 298.150659] binder: BINDER_SET_CONTEXT_MGR already set [ 298.160322] binder: 18872:18874 ioctl 40046207 0 returned -16 [ 298.169980] binder: 18879:18880 ioctl 40046207 0 returned -16 [ 298.177328] binder_alloc: 18877: binder_alloc_buf, no vma 03:35:23 executing program 3: 03:35:23 executing program 7: [ 298.180622] binder: 18872:18874 ERROR: BC_REGISTER_LOOPER called without request [ 298.182994] binder: 18877:18882 transaction failed 29189/-3, size 0-0 line 2967 [ 298.191570] binder: 18879:18880 ERROR: BC_REGISTER_LOOPER called without request [ 298.207385] binder_alloc: 18877: binder_alloc_buf, no vma [ 298.213114] binder: 18879:18880 transaction failed 29189/-3, size 0-0 line 2967 03:35:23 executing program 7: 03:35:23 executing program 3: [ 298.272885] binder: undelivered TRANSACTION_ERROR: 29189 03:35:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0) poll(&(0x7f0000000380)=[{r1}, {r0}], 0x2, 0xffffffffffffffff) 03:35:23 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)={0x77359400}) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000100)='bdev\x00', 0x100000, &(0x7f0000000280)) mount(&(0x7f0000000380)='./file0\x00', &(0x7f00000002c0)='.', &(0x7f0000000440)="045b898f73", 0x1004, 0x0) mount(&(0x7f00000003c0)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000ac0)) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f00000009c0)='mqueue\x00', 0x0, &(0x7f0000000a00)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000004c0)) rename(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000480)='./file0/file0\x00') 03:35:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000fcdfe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 298.405625] device bridge_slave_1 left promiscuous mode [ 298.411407] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.452418] device bridge_slave_0 left promiscuous mode [ 298.455810] IPVS: ftp: loaded support on port[0] = 21 [ 298.458631] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.500638] team0 (unregistering): Port device team_slave_1 removed [ 298.511133] team0 (unregistering): Port device team_slave_0 removed [ 298.523079] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 298.544706] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 298.578500] bond0 (unregistering): Released all slaves 03:35:24 executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) [ 298.984449] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.405465] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.411904] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.419623] device bridge_slave_0 entered promiscuous mode [ 299.457006] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.463473] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.471285] device bridge_slave_1 entered promiscuous mode [ 299.510741] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 299.548697] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 299.659893] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 299.700656] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 299.872885] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 299.880083] team0: Port device team_slave_0 added [ 299.909606] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 299.917096] team0: Port device team_slave_1 added [ 299.953336] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 299.989983] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 300.026707] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 300.067695] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 300.303375] bridge0: port 2(bridge_slave_1) entered blocking state [ 300.309794] bridge0: port 2(bridge_slave_1) entered forwarding state [ 300.316473] bridge0: port 1(bridge_slave_0) entered blocking state [ 300.322873] bridge0: port 1(bridge_slave_0) entered forwarding state [ 300.330301] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 301.174353] 8021q: adding VLAN 0 to HW filter on device bond0 [ 301.256738] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 301.338550] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 301.344771] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 301.353289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 301.360867] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 301.434635] 8021q: adding VLAN 0 to HW filter on device team0 03:35:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:35 executing program 0: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000080)="240000001a0025f0006bb404feff1436020b5aff6e10b5d55cd418cc080023db07020000", 0x24) [ 309.836103] binder: 19177:19178 ERROR: BC_REGISTER_LOOPER called without request [ 309.848045] binder: BINDER_SET_CONTEXT_MGR already set 03:35:35 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x0, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40400, 0x0) mmap(&(0x7f0000011000/0x4000)=nil, 0x4000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000432fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = socket$netlink(0x10, 0x3, 0x4000000) fcntl$lock(r1, 0x6, &(0x7f0000013000)) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000012000/0x4000)=nil, 0x4000}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000002000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 03:35:35 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r1, 0x4040ae72, &(0x7f0000000080)={0x1400, 0x3f}) 03:35:35 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:35 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 309.878070] binder: 19179:19180 ioctl 40046207 0 returned -16 [ 309.890460] binder: BINDER_SET_CONTEXT_MGR already set [ 309.901868] binder: 19184:19187 ioctl 40046207 0 returned -16 [ 309.906954] binder_alloc: 19177: binder_alloc_buf, no vma [ 309.913443] binder: 19179:19180 transaction failed 29189/-3, size 0-0 line 2967 [ 309.914100] binder: 19184:19187 ERROR: BC_REGISTER_LOOPER called without request 03:35:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000280)="295ee1311f16f477671070") prctl$seccomp(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) rt_sigsuspend(&(0x7f0000000040), 0x8) [ 309.939873] binder_alloc: 19177: binder_alloc_buf, no vma [ 309.945573] binder: 19184:19187 transaction failed 29189/-3, size 0-0 line 2967 [ 309.954455] binder: undelivered TRANSACTION_ERROR: 29189 03:35:35 executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20800084}, 0xc) [ 309.980657] audit: type=1326 audit(1528515335.563:5): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=19193 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4559f9 code=0xffff0000 03:35:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 310.169337] binder: BINDER_SET_CONTEXT_MGR already set [ 310.175153] binder: 19204:19205 ioctl 40046207 0 returned -16 [ 310.182120] binder: 19204:19205 ioctl c0306201 2000efd0 returned -11 03:35:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 310.214764] binder: BINDER_SET_CONTEXT_MGR already set [ 310.220355] binder: 19206:19207 ioctl 40046207 0 returned -16 [ 310.228502] binder: 19206:19207 ioctl c0306201 2000efd0 returned -11 03:35:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 310.263998] binder: BINDER_SET_CONTEXT_MGR already set [ 310.269770] binder: 19208:19209 ioctl 40046207 0 returned -16 [ 310.277942] binder: 19208:19209 ioctl c0306201 2000efd0 returned -11 03:35:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 310.312255] binder: BINDER_SET_CONTEXT_MGR already set [ 310.317864] binder: 19210:19211 ioctl 40046207 0 returned -16 [ 310.326396] binder: 19210:19211 ioctl c0306201 2000efd0 returned -11 [ 310.359450] binder: BINDER_SET_CONTEXT_MGR already set [ 310.365090] binder: 19212:19213 ioctl 40046207 0 returned -16 [ 310.371545] binder: 19212:19213 ioctl c0306201 2000efd0 returned -11 [ 310.699835] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.908757] audit: type=1326 audit(1528515336.491:6): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=19193 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4559f9 code=0xffff0000 03:35:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:36 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:36 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x0, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x11, 0x80002, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000000)={{0x2, 0x0, @multicast2=0xe0000002}, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x0, {0x2, 0x0, @loopback=0x7f000001}, 'veth0_to_team\x00'}) 03:35:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 311.003550] binder: 19230:19232 ERROR: BC_REGISTER_LOOPER called without request [ 311.010959] binder: BINDER_SET_CONTEXT_MGR already set [ 311.018837] binder: BINDER_SET_CONTEXT_MGR already set [ 311.025227] binder: BINDER_SET_CONTEXT_MGR already set [ 311.032199] binder: 19231:19237 ioctl 40046207 0 returned -16 [ 311.039643] binder: 19234:19238 ioctl 40046207 0 returned -16 [ 311.045952] binder: 19235:19236 ioctl 40046207 0 returned -16 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:36 executing program 3: r0 = memfd_create(&(0x7f0000000280)="ea62a1b374713239925a5a630a2ea0928999c4ff424e7ec5fdd80c4fe515feb740ecc67ec85884701621413d0aebb81d40144483a89d09d95845565708e0fad9ed7557af12a64b955e7a597adefbfd6ea94916b2dc935256f9398125ee6e6467b9d756760a5ea0f6873ce424b01ce1c53349e7731663674b63ddcfcf7073c44321e303b0e1a6df42881bd257739b18299839f64e9e2de0e55f021a3e0e93c6c6b41825c5c0f858730161455a", 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000440)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000380)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000000)={0x186}) [ 311.048765] binder_alloc: 19230: binder_alloc_buf, no vma [ 311.055197] binder: 19235:19236 ioctl c0306201 2000efd0 returned -11 [ 311.057512] binder: 19231:19237 transaction failed 29189/-3, size 0-0 line 2967 [ 311.064856] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.072466] binder: 19234:19238 ERROR: BC_REGISTER_LOOPER called without request [ 311.085833] binder_alloc: 19230: binder_alloc_buf, no vma [ 311.091615] binder: 19234:19238 transaction failed 29189/-3, size 0-0 line 2967 03:35:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x11, 0x80002, 0x0) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f00000001c0)={0x0, {0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, {0x2, 0x0, @dev={0xac, 0x14, 0x14}}, {0x2, 0x0, @multicast1=0xe0000001}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)='gre0\x00'}) 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 311.120061] binder: BINDER_SET_CONTEXT_MGR already set [ 311.127492] binder: 19245:19246 ioctl 40046207 0 returned -16 [ 311.135327] binder: 19245:19246 ioctl c0306201 2000efd0 returned -11 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:36 executing program 3: clone(0x200, &(0x7f0000001900), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000080), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='io\x00') pread64(r0, &(0x7f00009f3000), 0x352, 0x0) lseek(r0, 0x0, 0x2) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x827e, 0x0) [ 311.188722] binder: BINDER_SET_CONTEXT_MGR already set [ 311.194167] binder: 19255:19256 ioctl 40046207 0 returned -16 [ 311.200470] binder: 19255:19256 ioctl c0306201 2000efd0 returned -11 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 311.230423] binder: BINDER_SET_CONTEXT_MGR already set [ 311.239061] binder: 19257:19258 ioctl 40046207 0 returned -16 [ 311.247470] binder: 19257:19258 ioctl c0306201 2000efd0 returned -11 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 311.286401] binder: BINDER_SET_CONTEXT_MGR already set [ 311.292155] binder: 19263:19264 ioctl 40046207 0 returned -16 [ 311.298697] binder: 19263:19264 ioctl c0306201 2000efd0 returned -11 [ 311.828503] binder: undelivered TRANSACTION_ERROR: 29189 03:35:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:37 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 312.158605] binder: BINDER_SET_CONTEXT_MGR already set [ 312.164144] binder: BINDER_SET_CONTEXT_MGR already set [ 312.166090] binder: 19290:19292 ioctl 40046207 0 returned -16 [ 312.170289] binder: 19289:19296 ioctl 40046207 0 returned -16 [ 312.181723] binder: 19288:19291 ERROR: BC_REGISTER_LOOPER called without request [ 312.192548] binder_alloc: 19288: binder_alloc_buf, no vma [ 312.198289] binder: 19288:19291 transaction failed 29189/-3, size 0-0 line 2967 03:35:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 312.200355] binder_alloc: 19288: binder_alloc_buf, no vma [ 312.210098] binder: 19289:19296 ERROR: BC_REGISTER_LOOPER called without request [ 312.211453] binder: 19290:19292 transaction failed 29189/-3, size 0-0 line 2967 [ 312.237915] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 312.249381] binder: undelivered TRANSACTION_ERROR: 29189 03:35:37 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 312.346567] binder: BINDER_SET_CONTEXT_MGR already set [ 312.352267] binder: 19309:19310 ioctl 40046207 0 returned -16 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 312.437748] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 312.494857] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 312.545523] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 312.967531] binder: undelivered TRANSACTION_ERROR: 29189 03:35:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:38 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:38 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 313.164888] binder: 19331:19332 ERROR: BC_REGISTER_LOOPER called without request [ 313.188482] binder: BINDER_SET_CONTEXT_MGR already set [ 313.196401] binder: BINDER_SET_CONTEXT_MGR already set [ 313.204339] binder: BINDER_SET_CONTEXT_MGR already set 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.208780] binder: 19336:19342 ioctl 40046207 0 returned -16 [ 313.210007] binder: 19333:19337 ioctl 40046207 0 returned -16 [ 313.224641] binder_alloc: 19331: binder_alloc_buf, no vma [ 313.230326] binder: 19336:19342 transaction failed 29189/-3, size 0-0 line 2967 [ 313.235942] binder: 19343:19344 ioctl 40046207 0 returned -16 [ 313.248675] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.257886] binder: 19333:19337 ERROR: BC_REGISTER_LOOPER called without request 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.271743] binder_alloc: 19331: binder_alloc_buf, no vma [ 313.277509] binder: 19333:19337 transaction failed 29189/-3, size 0-0 line 2967 03:35:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.346380] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.392465] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.444090] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.499151] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 313.550211] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 313.595883] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 314.025543] binder: undelivered TRANSACTION_ERROR: 29189 03:35:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:39 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:39 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:39 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) dup3(r3, r1, 0x0) [ 314.238419] binder: BINDER_SET_CONTEXT_MGR already set [ 314.242536] binder: 19388:19391 ERROR: BC_REGISTER_LOOPER called without request [ 314.249093] binder: BINDER_SET_CONTEXT_MGR already set [ 314.257203] binder: BINDER_SET_CONTEXT_MGR already set [ 314.260329] binder: 19387:19389 ioctl 40046207 0 returned -16 [ 314.270965] binder: 19385:19392 ioctl 40046207 0 returned -16 [ 314.276253] binder: 19381:19383 ioctl 40046207 0 returned -16 [ 314.280856] binder_alloc: 19388: binder_alloc_buf, no vma 03:35:39 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) dup3(r3, r1, 0x0) [ 314.288505] binder: 19388:19391 transaction failed 29189/-3, size 0-0 line 2967 [ 314.291819] binder_alloc: 19388: binder_alloc_buf, no vma [ 314.301772] binder: 19387:19389 transaction failed 29189/-3, size 0-0 line 2967 03:35:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) dup3(r3, r1, 0x0) 03:35:39 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 314.338509] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.362353] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:40 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 314.437749] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:40 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 314.500685] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 314.585984] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 315.065995] binder: undelivered TRANSACTION_ERROR: 29189 03:35:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:40 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:40 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:40 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x0, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:40 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 315.288772] binder: BINDER_SET_CONTEXT_MGR already set [ 315.294195] binder: BINDER_SET_CONTEXT_MGR already set [ 315.296867] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 315.314577] binder: 19439:19444 ioctl 40046207 0 returned -16 [ 315.320165] binder: 19438:19442 ioctl 40046207 0 returned -16 [ 315.329239] binder: release 19439:19444 transaction 120 out, still active 03:35:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:40 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 315.336291] binder: undelivered TRANSACTION_COMPLETE 03:35:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 315.412097] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 315.459231] binder: BINDER_SET_CONTEXT_MGR already set [ 315.469991] binder: 19458:19459 ioctl 40046207 0 returned -16 [ 315.493854] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 315.500541] binder: 19458:19459 ioctl c0306201 2000efd0 returned -11 [ 315.551448] binder: BINDER_SET_CONTEXT_MGR already set [ 315.559143] binder: 19471:19472 ioctl 40046207 0 returned -16 [ 315.577830] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 315.581643] binder: 19471:19472 ioctl c0306201 2000efd0 returned -11 [ 316.089581] binder: send failed reply for transaction 120, target dead [ 316.096418] binder: send failed reply for transaction 121 to 19438:19442 [ 316.127662] binder: undelivered TRANSACTION_COMPLETE [ 316.132890] binder: undelivered TRANSACTION_ERROR: 29189 [ 316.159757] NFS: bad mount option value specified: vxfs 03:35:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:41 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x0, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:41 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:41 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 316.325906] binder: BINDER_SET_CONTEXT_MGR already set [ 316.336771] binder: BINDER_SET_CONTEXT_MGR already set [ 316.339365] binder: 19488:19490 ioctl 40046207 0 returned -16 [ 316.342841] binder: BINDER_SET_CONTEXT_MGR already set [ 316.349884] binder: 19488:19490 ERROR: BC_REGISTER_LOOPER called without request [ 316.368162] binder: 19492:19496 ioctl 40046207 0 returned -16 03:35:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 316.384372] binder: 19491:19495 ioctl 40046207 0 returned -16 [ 316.398419] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 316.420319] binder: 19492:19496 ioctl c0306201 2000efd0 returned -11 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 316.456196] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 316.478763] binder: BINDER_SET_CONTEXT_MGR already set [ 316.484382] binder: 19509:19510 ioctl 40046207 0 returned -16 [ 316.490881] binder: 19509:19510 ioctl c0306201 2000efd0 returned -11 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 316.524128] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 316.547089] binder: BINDER_SET_CONTEXT_MGR already set [ 316.553185] binder: 19514:19515 ioctl 40046207 0 returned -16 [ 316.566379] binder: 19514:19515 ioctl c0306201 2000efd0 returned -11 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 316.579623] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 316.614927] binder: BINDER_SET_CONTEXT_MGR already set [ 316.620708] binder: 19519:19520 ioctl 40046207 0 returned -16 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 316.628625] binder: 19519:19520 ioctl c0306201 2000efd0 returned -11 [ 316.642628] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 316.680831] binder: BINDER_SET_CONTEXT_MGR already set [ 316.687372] binder: 19524:19525 ioctl 40046207 0 returned -16 [ 316.696411] binder: 19524:19525 ioctl c0306201 2000efd0 returned -11 [ 317.150340] binder: send failed reply for transaction 123 to 19491:19495 [ 317.168443] binder: undelivered TRANSACTION_COMPLETE [ 317.173678] binder: undelivered TRANSACTION_ERROR: 29189 [ 317.192605] NFS: bad mount option value specified: vxfs 03:35:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:42 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:42 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x0, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:42 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 317.349335] binder: BINDER_SET_CONTEXT_MGR already set [ 317.360783] binder: BINDER_SET_CONTEXT_MGR already set [ 317.366524] binder: BINDER_SET_CONTEXT_MGR already set [ 317.372180] binder: 19543:19545 ioctl 40046207 0 returned -16 [ 317.378326] binder: 19547:19549 ioctl 40046207 0 returned -16 [ 317.383053] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 317.384411] binder: 19537:19541 ioctl 40046207 0 returned -16 [ 317.402514] binder: 19543:19545 ERROR: BC_REGISTER_LOOPER called without request [ 317.410939] binder: 19547:19549 ioctl c0306201 2000efd0 returned -11 03:35:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 317.447538] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 317.467780] binder: BINDER_SET_CONTEXT_MGR already set [ 317.473547] binder: 19555:19556 ioctl 40046207 0 returned -16 [ 317.481373] binder: 19555:19556 ioctl c0306201 2000efd0 returned -11 03:35:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 317.512461] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 317.525865] binder: BINDER_SET_CONTEXT_MGR already set [ 317.531415] binder: 19560:19561 ioctl 40046207 0 returned -16 [ 317.538305] binder: 19560:19561 ioctl c0306201 2000efd0 returned -11 03:35:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 317.575550] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 317.584374] binder: BINDER_SET_CONTEXT_MGR already set [ 317.591636] binder: 19565:19566 ioctl 40046207 0 returned -16 [ 317.601556] binder: 19565:19566 ioctl c0306201 2000efd0 returned -11 [ 317.639315] binder: BINDER_SET_CONTEXT_MGR already set [ 317.645299] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 317.654272] binder: 19567:19569 ioctl 40046207 0 returned -16 [ 317.663331] binder: 19567:19569 ioctl c0306201 2000efd0 returned -11 [ 318.163905] binder: release 19537:19541 transaction 125 out, still active [ 318.171039] binder: undelivered TRANSACTION_COMPLETE [ 318.177829] binder: send failed reply for transaction 125, target dead [ 318.210442] NFS: bad mount option value specified: vxfs 03:35:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:43 executing program 2: 03:35:43 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:43 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(0xffffffffffffffff, r1, 0x0) [ 318.370874] binder: BINDER_SET_CONTEXT_MGR already set [ 318.377876] binder: BINDER_SET_CONTEXT_MGR already set [ 318.384348] binder: BINDER_SET_CONTEXT_MGR already set [ 318.386710] binder: 19581:19586 ERROR: BC_REGISTER_LOOPER called without request [ 318.400161] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 318.401675] binder: 19584:19585 ioctl 40046207 0 returned -16 03:35:44 executing program 2: 03:35:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r1, 0xffffffffffffffff, 0x0) 03:35:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 318.416578] binder: 19582:19583 ioctl 40046207 0 returned -16 [ 318.423229] binder: 19588:19590 ioctl 40046207 0 returned -16 [ 318.433116] binder: send failed reply for transaction 127 to 19582:19583 [ 318.435839] binder: 19588:19590 ioctl c0306201 2000efd0 returned -11 03:35:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 318.488113] binder: 19581:19586 ioctl c0306201 2000efd0 returned -14 03:35:44 executing program 2: [ 318.536607] binder: BINDER_SET_CONTEXT_MGR already set [ 318.561405] binder: 19603:19604 ioctl 40046207 0 returned -16 [ 318.577789] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 318.595719] binder: 19603:19604 ioctl c0306201 2000efd0 returned -11 [ 319.174264] binder: undelivered TRANSACTION_COMPLETE [ 319.179531] binder: undelivered TRANSACTION_ERROR: 29201 03:35:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 2: 03:35:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 7: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:45 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:45 executing program 2: [ 319.446049] binder: BINDER_SET_CONTEXT_MGR already set [ 319.454176] binder: BINDER_SET_CONTEXT_MGR already set [ 319.455392] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 319.470451] binder: BINDER_SET_CONTEXT_MGR already set [ 319.475720] binder: 19620:19621 ioctl 40046207 0 returned -16 [ 319.489142] binder: 19626:19627 ioctl 40046207 0 returned -16 [ 319.511594] binder: 19626:19627 ioctl c0306201 2000efd0 returned -11 [ 319.518539] binder: 19623:19625 ioctl 40046207 0 returned -16 [ 319.531163] binder: 19623:19625 ERROR: BC_REGISTER_LOOPER called without request 03:35:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 7: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:45 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x0, 0x0, &(0x7f0000003fe8)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 320.259374] binder: send failed reply for transaction 129 to 19620:19621 [ 320.272950] binder: undelivered TRANSACTION_COMPLETE [ 320.278283] binder: undelivered TRANSACTION_ERROR: 29189 [ 320.337527] binder: BINDER_SET_CONTEXT_MGR already set [ 320.345478] binder: BINDER_SET_CONTEXT_MGR already set [ 320.355506] binder: BINDER_SET_CONTEXT_MGR already set [ 320.356673] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 320.361406] binder: BINDER_SET_CONTEXT_MGR already set [ 320.375858] binder: 19643:19646 ioctl 40046207 0 returned -16 03:35:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 320.385204] binder: 19651:19653 ioctl 40046207 0 returned -16 [ 320.390088] binder: 19652:19654 ioctl 40046207 0 returned -16 [ 320.396178] binder: 19651:19653 ERROR: BC_REGISTER_LOOPER called without request [ 320.408473] binder: 19643:19646 ERROR: BC_REGISTER_LOOPER called without request [ 320.422300] binder: 19645:19655 ioctl 40046207 0 returned -16 [ 320.428980] binder: 19652:19654 ioctl c0306201 2000efd0 returned -11 03:35:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 320.454426] binder: 19645:19655 ERROR: BC_REGISTER_LOOPER called without request 03:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 320.504454] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 320.546322] binder: BINDER_SET_CONTEXT_MGR already set [ 320.553789] binder: 19670:19672 ioctl 40046207 0 returned -16 [ 320.560803] binder: 19670:19672 ioctl c0306201 2000efd0 returned -11 [ 321.139533] binder: send failed reply for transaction 131 to 19642:19648 [ 321.146655] binder: send failed reply for transaction 132 to 19643:19646 [ 321.173782] binder: undelivered TRANSACTION_COMPLETE [ 321.179070] binder: undelivered TRANSACTION_ERROR: 29189 03:35:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0), 0x0, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:46 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = bpf$MAP_CREATE(0x0, &(0x7f000000bfd4)={0x5, 0x23, 0x5, 0x3, 0x0, 0x1}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r1, 0x406}, 0x5) 03:35:46 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:46 executing program 7: socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 321.190528] binder: undelivered TRANSACTION_COMPLETE [ 321.195756] binder: undelivered TRANSACTION_ERROR: 29189 [ 321.254353] binder: 19685:19687 ERROR: BC_REGISTER_LOOPER called without request [ 321.254567] binder: BINDER_SET_CONTEXT_MGR already set [ 321.268422] binder: BINDER_SET_CONTEXT_MGR already set [ 321.273840] binder: BINDER_SET_CONTEXT_MGR already set [ 321.276890] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 321.285364] binder: 19686:19692 ioctl 40046207 0 returned -16 [ 321.295773] binder: 19684:19691 ioctl 40046207 0 returned -16 03:35:46 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='environ\x00') ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000140)={0x5}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000200)) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000001c0)='tls\x00', 0x4) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)='net/dev\x00') preadv(r0, &(0x7f00000023c0)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1, 0x0) 03:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 321.307527] binder: 19681:19694 ioctl 40046207 0 returned -16 [ 321.321724] binder: 19684:19691 ERROR: BC_REGISTER_LOOPER called without request [ 321.330443] binder: 19681:19694 ioctl c0306201 2000efd0 returned -11 [ 321.343607] binder: 19686:19692 ERROR: BC_REGISTER_LOOPER called without request 03:35:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 321.393358] binder: BINDER_SET_CONTEXT_MGR already set [ 321.399678] binder: 19705:19706 ioctl 40046207 0 returned -16 [ 321.406761] binder: 19705:19706 ioctl c0306201 2000efd0 returned -11 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 321.434554] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 321.481244] binder: BINDER_SET_CONTEXT_MGR already set [ 321.510092] binder: 19710:19711 ioctl 40046207 0 returned -16 [ 321.528088] binder: 19710:19711 ioctl c0306201 2000efd0 returned -11 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 2: [ 321.551267] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 321.591566] binder: BINDER_SET_CONTEXT_MGR already set [ 321.597572] binder: 19716:19717 ioctl 40046207 0 returned -16 [ 321.604637] binder: 19716:19717 ioctl c0306201 2000efd0 returned -11 [ 321.642969] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:47 executing program 2: 03:35:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0), 0x0, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:47 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:47 executing program 2: [ 322.154359] binder: BINDER_SET_CONTEXT_MGR already set [ 322.161519] binder: BINDER_SET_CONTEXT_MGR already set [ 322.170326] binder: BINDER_SET_CONTEXT_MGR already set [ 322.174497] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 322.185872] binder: 19736:19742 ioctl 40046207 0 returned -16 [ 322.186822] binder: 19737:19740 ioctl 40046207 0 returned -16 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 322.206252] binder: 19735:19741 ioctl 40046207 0 returned -16 [ 322.214845] binder: 19737:19740 ERROR: BC_REGISTER_LOOPER called without request [ 322.231540] binder: 19736:19742 ERROR: BC_REGISTER_LOOPER called without request 03:35:47 executing program 2: 03:35:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 322.261723] binder: 19735:19741 ERROR: BC_REGISTER_LOOPER called without request [ 322.273010] binder_alloc: 19749: binder_alloc_buf, no vma [ 322.278829] binder: 19735:19741 transaction failed 29189/-3, size 0-0 line 2967 03:35:47 executing program 2: [ 322.329785] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:35:47 executing program 2: 03:35:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(0xffffffffffffffff, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 322.372417] binder: undelivered TRANSACTION_ERROR: 29189 03:35:48 executing program 2: [ 322.457797] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:35:48 executing program 2: 03:35:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:48 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:48 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0), 0x0, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 323.058112] binder: BINDER_SET_CONTEXT_MGR already set [ 323.064870] binder: BINDER_SET_CONTEXT_MGR already set [ 323.070406] binder: BINDER_SET_CONTEXT_MGR already set [ 323.079412] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 323.085279] binder: 19784:19790 ioctl 40046207 0 returned -16 [ 323.093183] binder: 19777:19782 ioctl 40046207 0 returned -16 [ 323.102673] binder: 19781:19791 ioctl 40046207 0 returned -16 03:35:48 executing program 2: 03:35:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:35:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:48 executing program 2: [ 323.119125] binder: 19781:19791 ERROR: BC_REGISTER_LOOPER called without request [ 323.131072] binder: 19777:19782 ERROR: BC_REGISTER_LOOPER called without request [ 323.147851] binder: 19784:19790 ERROR: BC_REGISTER_LOOPER called without request 03:35:48 executing program 2: 03:35:48 executing program 0: [ 323.187307] binder_alloc: 19796: binder_alloc_buf, no vma [ 323.193019] binder: 19784:19790 transaction failed 29189/-3, size 0-0 line 2967 [ 323.239360] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 323.301563] binder: undelivered TRANSACTION_ERROR: 29189 03:35:49 executing program 2: 03:35:49 executing program 0: 03:35:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x0, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x0) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:49 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r2, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r2, r0, 0x0) 03:35:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 323.939179] binder: BINDER_SET_CONTEXT_MGR already set [ 323.951456] binder: 19813:19814 ERROR: BC_REGISTER_LOOPER called without request [ 323.964394] binder: 19815:19821 ioctl 40046207 0 returned -16 [ 323.969775] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:49 executing program 0: 03:35:49 executing program 2: [ 323.987939] binder: BINDER_SET_CONTEXT_MGR already set 03:35:49 executing program 0: 03:35:49 executing program 2: [ 324.025923] binder: 19815:19821 ERROR: BC_REGISTER_LOOPER called without request [ 324.033852] binder: 19826:19828 ioctl 40046207 0 returned -16 [ 324.057638] binder: 19826:19828 ERROR: BC_REGISTER_LOOPER called without request 03:35:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:49 executing program 2: [ 324.075388] binder: release 19813:19814 transaction 143 out, still active [ 324.082637] binder: undelivered TRANSACTION_COMPLETE [ 324.087933] binder: send failed reply for transaction 143, target dead 03:35:49 executing program 0: 03:35:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 324.122716] binder: 19813:19814 ioctl c0306201 2000efd0 returned -14 [ 324.140062] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:49 executing program 2: 03:35:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 324.255820] binder: 19847:19850 ERROR: BC_REGISTER_LOOPER called without request [ 324.261251] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 324.276879] binder: release 19847:19850 transaction 145 out, still active [ 324.283997] binder: undelivered TRANSACTION_COMPLETE [ 324.294788] binder: send failed reply for transaction 145, target dead [ 324.311522] binder: 19847:19850 ioctl c0306201 2000efd0 returned -14 03:35:50 executing program 0: 03:35:50 executing program 2: 03:35:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x0, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:50 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:50 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x0) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 324.845749] binder: 19866:19868 ERROR: BC_REGISTER_LOOPER called without request [ 324.849924] binder: BINDER_SET_CONTEXT_MGR already set [ 324.864943] binder: BINDER_SET_CONTEXT_MGR already set [ 324.874865] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 324.883775] binder: 19860:19872 ioctl 40046207 0 returned -16 03:35:50 executing program 2: 03:35:50 executing program 0: [ 324.895618] binder: 19864:19865 ioctl 40046207 0 returned -16 [ 324.916880] binder: 19864:19865 ERROR: BC_REGISTER_LOOPER called without request [ 324.924890] binder: 19860:19872 ERROR: BC_REGISTER_LOOPER called without request 03:35:50 executing program 2: 03:35:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:50 executing program 0: [ 324.952767] binder: send failed reply for transaction 147 to 19864:19865 [ 324.960924] binder: undelivered TRANSACTION_COMPLETE [ 324.966231] binder: undelivered TRANSACTION_ERROR: 29201 [ 324.981311] binder: 19866:19868 ioctl c0306201 2000efd0 returned -14 03:35:50 executing program 2: 03:35:50 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 325.040732] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 325.102121] binder: 19889:19890 ERROR: BC_REGISTER_LOOPER called without request 03:35:51 executing program 0: 03:35:51 executing program 2: 03:35:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x0) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:51 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:51 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:51 executing program 0: [ 325.931541] binder: 19901:19903 ERROR: BC_REGISTER_LOOPER called without request [ 325.940498] binder: BINDER_SET_CONTEXT_MGR already set [ 325.961362] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 325.969159] binder: BINDER_SET_CONTEXT_MGR already set 03:35:51 executing program 2: [ 325.977604] binder: 19900:19908 ioctl 40046207 0 returned -16 [ 325.999222] binder: release 19901:19903 transaction 150 out, still active [ 325.999490] binder: 19912:19913 ioctl 40046207 0 returned -16 [ 326.006339] binder: undelivered TRANSACTION_COMPLETE [ 326.006706] binder: send failed reply for transaction 150, target dead 03:35:51 executing program 0: 03:35:51 executing program 2: r0 = socket$inet6(0xa, 0x100000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0xe}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) 03:35:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000), 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 326.028915] binder: 19901:19903 ioctl c0306201 2000efd0 returned -14 [ 326.037202] binder: 19900:19908 ERROR: BC_REGISTER_LOOPER called without request [ 326.056918] binder: 19912:19913 ERROR: BC_REGISTER_LOOPER called without request 03:35:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x5}, 0x1c) r1 = gettid() r2 = fcntl$dupfd(r0, 0x0, r0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") readv(r2, &(0x7f0000000040)=[{&(0x7f0000000280)=""/176, 0xb0}], 0x1) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [], 0xaa}, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1004000000016) 03:35:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 326.120921] binder: send failed reply for transaction 151 to 19912:19913 [ 326.142762] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1}, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x1c) [ 326.171993] binder: 19927:19929 ERROR: BC_REGISTER_LOOPER called without request [ 326.196376] binder: send failed reply for transaction 153 to 19927:19929 [ 326.203531] binder: undelivered TRANSACTION_COMPLETE [ 326.208733] binder: undelivered TRANSACTION_ERROR: 29201 [ 326.214605] binder: 19927:19929 ioctl c0306201 2000efd0 returned -14 03:35:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 326.261792] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 326.290239] binder: 19938:19939 ERROR: BC_REGISTER_LOOPER called without request 03:35:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:51 executing program 2: r0 = socket$inet(0x2, 0x100000000000002, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000080)="2957e1311f16f477671070") setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x14, 0xd}}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast2=0xe0000002, @remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0x4, [@loopback=0x7f000001, @multicast1=0xe0000001, @empty, @loopback=0x7f000001]}, 0x20) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000100)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0x10) [ 326.316145] binder: release 19938:19939 transaction 155 out, still active [ 326.323324] binder: undelivered TRANSACTION_COMPLETE [ 326.323757] binder: send failed reply for transaction 155, target dead [ 326.336121] binder: 19938:19939 ioctl c0306201 2000efd0 returned -14 [ 326.375947] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:52 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:52 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:52 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="8905", 0x2) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 326.774254] binder: 19954:19956 ERROR: BC_REGISTER_LOOPER called without request [ 326.786292] binder: undelivered TRANSACTION_COMPLETE [ 326.791637] binder: undelivered TRANSACTION_ERROR: 29189 [ 326.823412] binder: BINDER_SET_CONTEXT_MGR already set [ 326.826354] binder: 19962:19965 ERROR: BC_REGISTER_LOOPER called without request [ 326.842181] binder: BINDER_SET_CONTEXT_MGR already set [ 326.853331] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 326.857109] binder: 19969:19970 ioctl 40046207 0 returned -16 [ 326.863951] binder: 19961:19963 ioctl 40046207 0 returned -16 [ 326.873868] binder: send failed reply for transaction 157 to 19962:19965 [ 326.888739] binder: 19969:19970 ERROR: BC_REGISTER_LOOPER called without request [ 326.893747] binder: 19961:19963 ERROR: BC_REGISTER_LOOPER called without request [ 326.900690] binder: 19954:19956 ioctl c0306201 2000efd0 returned -14 03:35:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 326.940596] binder: release 19961:19963 transaction 159 out, still active [ 326.947654] binder: undelivered TRANSACTION_COMPLETE [ 326.970507] binder: send failed reply for transaction 158 to 19969:19970 [ 326.977527] binder: send failed reply for transaction 159, target dead [ 326.987459] binder: 19979:19981 ERROR: BC_REGISTER_LOOPER called without request [ 326.997383] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 327.638671] binder: undelivered TRANSACTION_COMPLETE [ 327.643950] binder: undelivered TRANSACTION_ERROR: 29201 [ 327.669214] binder: undelivered TRANSACTION_COMPLETE [ 327.674447] binder: undelivered TRANSACTION_ERROR: 29189 03:35:53 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:35:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:53 executing program 2: socket$inet6(0xa, 0x1, 0x1) r0 = getpgid(0xffffffffffffffff) ioprio_get$pid(0x2, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$KDDISABIO(r1, 0x4b37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff}) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) syz_fuse_mount(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='securityfs\x00', 0x0, 0x0) read(r3, &(0x7f0000003380)=""/4096, 0xf) connect$unix(r2, &(0x7f0000000640)=@abs, 0x6e) 03:35:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:53 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 327.805480] binder: BINDER_SET_CONTEXT_MGR already set [ 327.814806] binder: 19995:19999 ERROR: BC_REGISTER_LOOPER called without request [ 327.816609] binder: 20002:20004 ioctl 40046207 0 returned -16 [ 327.831518] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 327.849733] binder: BINDER_SET_CONTEXT_MGR already set [ 327.856101] binder: send failed reply for transaction 162 to 19995:19999 [ 327.863217] binder: undelivered TRANSACTION_COMPLETE [ 327.866503] binder: 20012:20013 ioctl 40046207 0 returned -16 [ 327.868419] binder: undelivered TRANSACTION_ERROR: 29201 [ 327.881773] binder: 19995:19999 ioctl c0306201 2000efd0 returned -14 [ 327.881939] binder: 20002:20004 ERROR: BC_REGISTER_LOOPER called without request 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528", 0x3) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 327.900408] binder: 20012:20013 ERROR: BC_REGISTER_LOOPER called without request [ 327.919681] binder: send failed reply for transaction 163 to 20002:20004 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 327.960954] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 327.969760] binder: 20020:20021 ERROR: BC_REGISTER_LOOPER called without request [ 327.980318] binder: release 20020:20021 transaction 165 out, still active [ 327.987573] binder: undelivered TRANSACTION_COMPLETE [ 327.996393] binder: send failed reply for transaction 165, target dead 03:35:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 328.010136] binder: 20020:20021 ioctl c0306201 2000efd0 returned -14 [ 328.014623] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 328.084808] binder: 20028:20030 ERROR: BC_REGISTER_LOOPER called without request [ 328.088142] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 328.100307] binder: release 20028:20030 transaction 167 out, still active [ 328.109610] binder: undelivered TRANSACTION_COMPLETE [ 328.115215] binder: send failed reply for transaction 167, target dead [ 328.122393] binder: 20028:20030 ioctl c0306201 2000efd0 returned -14 [ 328.158469] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 328.187992] binder: 20035:20036 ERROR: BC_REGISTER_LOOPER called without request [ 328.198829] binder: release 20035:20036 transaction 169 out, still active 03:35:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 328.205894] binder: undelivered TRANSACTION_COMPLETE [ 328.208346] binder: send failed reply for transaction 169, target dead [ 328.218113] binder: 20035:20036 ioctl c0306201 2000efd0 returned -14 [ 328.251905] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 328.634226] binder: undelivered TRANSACTION_COMPLETE [ 328.639525] binder: undelivered TRANSACTION_ERROR: 29189 03:35:54 executing program 0: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:35:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:54 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:35:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) recvmmsg(0xffffffffffffffff, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 328.845867] binder: BINDER_SET_CONTEXT_MGR already set [ 328.853482] binder: BINDER_SET_CONTEXT_MGR already set [ 328.855756] binder: 20052:20053 ERROR: BC_REGISTER_LOOPER called without request [ 328.864738] binder: 20059:20062 ioctl 40046207 0 returned -16 [ 328.872630] binder: 20058:20060 ioctl 40046207 0 returned -16 [ 328.890891] binder: 20058:20060 ERROR: BC_REGISTER_LOOPER called without request [ 328.893596] binder: 20059:20062 ERROR: BC_REGISTER_LOOPER called without request [ 329.022198] binder: BINDER_SET_CONTEXT_MGR already set [ 329.033940] binder: 20064:20065 ioctl 40046207 0 returned -16 [ 329.043106] binder: 20064:20065 ERROR: BC_REGISTER_LOOPER called without request 03:35:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 329.104300] binder: send failed reply for transaction 171 to 20052:20053 [ 329.107973] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 329.111395] binder: undelivered TRANSACTION_COMPLETE [ 329.122264] binder: 20052:20053 ioctl c0306201 2000efd0 returned -14 [ 329.126462] binder: undelivered TRANSACTION_ERROR: 29201 03:35:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 329.192229] binder: send failed reply for transaction 172 to 20059:20062 03:35:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) recvmmsg(0xffffffffffffffff, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 329.258566] binder: 20070:20071 ERROR: BC_REGISTER_LOOPER called without request [ 329.345147] IPVS: ftp: loaded support on port[0] = 21 03:35:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000), 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 329.564416] binder: release 20070:20071 transaction 174 out, still active [ 329.571673] binder: undelivered TRANSACTION_COMPLETE [ 329.578110] binder: send failed reply for transaction 174, target dead [ 329.581183] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 329.585248] binder: 20070:20071 ioctl c0306201 2000efd0 returned -14 03:35:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:35:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:35:55 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 329.700117] binder: 20078:20079 ERROR: BC_REGISTER_LOOPER called without request [ 329.716681] binder: undelivered TRANSACTION_COMPLETE [ 329.722010] binder: undelivered TRANSACTION_ERROR: 29189 [ 329.763745] binder: BINDER_SET_CONTEXT_MGR already set [ 329.796693] binder: BINDER_SET_CONTEXT_MGR already set [ 329.804776] binder: 20086:20087 ioctl 40046207 0 returned -16 [ 329.812618] binder: 20089:20090 ioctl 40046207 0 returned -16 [ 329.826489] binder: 20086:20087 ERROR: BC_REGISTER_LOOPER called without request [ 329.839606] binder: 20089:20090 ERROR: BC_REGISTER_LOOPER called without request [ 329.922894] binder: send failed reply for transaction 176 to 20078:20079 [ 329.929952] binder: undelivered TRANSACTION_COMPLETE [ 329.935166] binder: undelivered TRANSACTION_ERROR: 29201 [ 329.942187] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 329.953126] binder: 20078:20079 ioctl c0306201 2000efd0 returned -14 [ 330.012769] binder: send failed reply for transaction 177 to 20089:20090 [ 330.620710] binder: undelivered TRANSACTION_COMPLETE [ 330.625976] binder: undelivered TRANSACTION_ERROR: 29189 [ 331.005281] device bridge_slave_1 left promiscuous mode [ 331.010910] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.022960] device bridge_slave_0 left promiscuous mode [ 331.028564] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.080960] team0 (unregistering): Port device team_slave_1 removed [ 333.092626] team0 (unregistering): Port device team_slave_0 removed [ 333.102588] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 333.121233] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 333.148297] bond0 (unregistering): Released all slaves [ 333.400062] bridge0: port 1(bridge_slave_0) entered blocking state [ 333.406585] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.414521] device bridge_slave_0 entered promiscuous mode [ 333.451415] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.457848] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.466485] device bridge_slave_1 entered promiscuous mode [ 333.503992] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 333.540384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 333.648372] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 333.694294] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 333.867131] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 333.875186] team0: Port device team_slave_0 added [ 333.910734] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 333.918574] team0: Port device team_slave_1 added [ 333.955933] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 333.996176] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 334.036858] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 334.076189] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 334.439923] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.446415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 334.453100] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.459483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 334.466731] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 335.199156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 335.345219] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.427360] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 335.508057] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 335.514358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 335.522135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 335.600778] 8021q: adding VLAN 0 to HW filter on device team0 03:36:01 executing program 0 (fault-call:11 fault-nth:0): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000), 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:36:01 executing program 2 (fault-call:4 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:01 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 336.177451] binder: 20358:20361 ERROR: BC_REGISTER_LOOPER called without request [ 336.182637] binder: BINDER_SET_CONTEXT_MGR already set [ 336.191090] binder: BINDER_SET_CONTEXT_MGR already set [ 336.193688] binder: 20360:20362 ioctl 40046207 0 returned -16 [ 336.198769] binder: 20363:20365 ioctl 40046207 0 returned -16 [ 336.213694] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 336.224984] binder: BINDER_SET_CONTEXT_MGR already set [ 336.230537] binder: 20360:20362 ERROR: BC_REGISTER_LOOPER called without request [ 336.233396] binder: 20368:20370 ioctl 40046207 0 returned -16 [ 336.239297] binder: send failed reply for transaction 179 to 20360:20362 [ 336.245514] binder: 20363:20365 ERROR: BC_REGISTER_LOOPER called without request [ 336.252684] binder: undelivered TRANSACTION_COMPLETE [ 336.263976] binder: undelivered TRANSACTION_ERROR: 29201 [ 336.264186] binder: 20368:20370 ioctl c0306201 2000efd0 returned -11 03:36:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000), 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 336.276546] binder: 20358:20361 ioctl c0306201 2000efd0 returned -14 03:36:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 336.303566] binder: send failed reply for transaction 180 to 20363:20365 [ 336.339886] binder: 20372:20376 ERROR: BC_REGISTER_LOOPER called without request 03:36:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:36:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 336.354797] binder: BINDER_SET_CONTEXT_MGR already set [ 336.363456] TCP: request_sock_TCPv6: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 336.374281] binder: 20378:20379 ioctl 40046207 0 returned -16 [ 336.384804] binder: 20378:20379 ioctl c0306201 2000efd0 returned -11 03:36:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 336.428476] binder: BINDER_SET_CONTEXT_MGR already set [ 336.443834] binder: 20381:20383 ioctl 40046207 0 returned -16 03:36:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 336.489404] binder: BINDER_SET_CONTEXT_MGR already set [ 336.498258] binder: 20388:20389 ioctl 40046207 0 returned -16 [ 337.010366] binder: undelivered TRANSACTION_COMPLETE [ 337.015625] binder: undelivered TRANSACTION_ERROR: 29189 [ 337.046744] FAULT_INJECTION: forcing a failure. [ 337.046744] name failslab, interval 1, probability 0, space 0, times 1 [ 337.058117] CPU: 1 PID: 20400 Comm: syz-executor0 Not tainted 4.17.0+ #91 [ 337.065059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 337.074594] Call Trace: [ 337.077205] dump_stack+0x1b9/0x294 [ 337.080859] ? dump_stack_print_info.cold.2+0x52/0x52 [ 337.086063] ? lock_release+0xa10/0xa10 [ 337.090042] ? check_same_owner+0x320/0x320 [ 337.094364] should_fail.cold.4+0xa/0x1a [ 337.098413] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 337.103505] ? lock_downgrade+0x8e0/0x8e0 [ 337.107663] ? kasan_check_read+0x11/0x20 [ 337.111821] ? rcu_is_watching+0x85/0x140 [ 337.115961] ? find_held_lock+0x36/0x1c0 [ 337.120032] ? check_same_owner+0x320/0x320 [ 337.124354] ? find_held_lock+0x36/0x1c0 [ 337.128413] ? rcu_note_context_switch+0x710/0x710 [ 337.133331] __should_failslab+0x124/0x180 [ 337.137567] should_failslab+0x9/0x14 [ 337.141362] kmem_cache_alloc+0x2af/0x760 [ 337.145496] ? __lock_is_held+0xb5/0x140 [ 337.149544] getname_flags+0xd0/0x5a0 [ 337.153340] do_rmdir+0xe3/0x610 [ 337.156692] ? __ia32_sys_mkdir+0x80/0x80 [ 337.160841] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 337.166384] ? ksys_write+0x1a6/0x250 [ 337.170174] ? __ia32_sys_read+0xb0/0xb0 [ 337.174237] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 337.179080] ? do_syscall_64+0x92/0x800 [ 337.183317] __x64_sys_rmdir+0x36/0x40 [ 337.187211] do_syscall_64+0x1b1/0x800 [ 337.191102] ? finish_task_switch+0x1ca/0x840 [ 337.195595] ? syscall_return_slowpath+0x5c0/0x5c0 [ 337.200524] ? syscall_return_slowpath+0x30f/0x5c0 [ 337.205463] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 337.210822] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 337.215667] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 337.220864] RIP: 0033:0x4559f9 [ 337.224039] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 337.243264] RSP: 002b:00007faac3413c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 337.250969] RAX: ffffffffffffffda RBX: 00007faac34146d4 RCX: 00000000004559f9 [ 337.258232] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000400 [ 337.265486] RBP: 000000000072bf50 R08: 0000000000000000 R09: 0000000000000000 [ 337.272746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 [ 337.280005] R13: 00000000004c073c R14: 00000000004cff38 R15: 0000000000000000 03:36:03 executing program 0 (fault-call:11 fault-nth:1): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 03:36:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 337.448013] binder: 20408:20410 ERROR: BC_REGISTER_LOOPER called without request [ 337.468652] binder: BINDER_SET_CONTEXT_MGR already set [ 337.474958] binder: BINDER_SET_CONTEXT_MGR already set [ 337.476680] binder: 20416:20417 ioctl 40046207 0 returned -16 [ 337.480450] binder: BINDER_SET_CONTEXT_MGR already set 03:36:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 337.489926] binder: 20416:20417 ERROR: BC_REGISTER_LOOPER called without request [ 337.502422] binder: send failed reply for transaction 183 to 20408:20410 [ 337.505566] binder: release 20416:20417 transaction 184 out, still active [ 337.509623] binder: 20413:20418 ioctl 40046207 0 returned -16 [ 337.516499] binder: undelivered TRANSACTION_COMPLETE [ 337.520428] binder: 20409:20419 ioctl 40046207 0 returned -16 [ 337.522553] binder: 20408:20410 ioctl c0306201 2000efd0 returned -14 [ 337.539771] binder: 20413:20418 ioctl 10 2000efd0 returned -22 03:36:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 337.554837] binder: 20409:20419 ERROR: BC_REGISTER_LOOPER called without request [ 337.576924] binder: send failed reply for transaction 184, target dead [ 337.586974] binder: undelivered TRANSACTION_COMPLETE [ 337.592271] binder: undelivered TRANSACTION_ERROR: 29201 03:36:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 337.622464] binder: 20426:20427 ERROR: BC_REGISTER_LOOPER called without request [ 337.650717] binder: send failed reply for transaction 186 to 20426:20427 03:36:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x0, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 337.675570] binder: 20426:20427 ioctl c0306201 2000efd0 returned -14 [ 337.713901] binder: BINDER_SET_CONTEXT_MGR already set 03:36:03 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 337.727252] binder: undelivered TRANSACTION_COMPLETE [ 337.732600] binder: undelivered TRANSACTION_ERROR: 29201 [ 337.733539] binder: 20432:20433 ioctl 40046207 0 returned -16 03:36:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f000063a000)=0x7fff, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa}, 0x1c) [ 337.769966] binder: 20438:20439 ERROR: BC_REGISTER_LOOPER called without request [ 337.793808] binder: send failed reply for transaction 188 to 20438:20439 [ 337.802969] binder: 20438:20439 ioctl c0306201 2000efd0 returned -14 [ 337.820842] binder: BINDER_SET_CONTEXT_MGR already set [ 337.840531] binder: 20441:20442 ioctl 40046207 0 returned -16 [ 337.849768] binder: undelivered TRANSACTION_COMPLETE [ 337.855079] binder: undelivered TRANSACTION_ERROR: 29201 [ 338.347985] FAULT_INJECTION: forcing a failure. [ 338.347985] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 338.359851] CPU: 0 PID: 20453 Comm: syz-executor0 Not tainted 4.17.0+ #91 [ 338.366773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 338.376115] Call Trace: [ 338.378699] dump_stack+0x1b9/0x294 [ 338.382334] ? dump_stack_print_info.cold.2+0x52/0x52 [ 338.387521] should_fail.cold.4+0xa/0x1a [ 338.391584] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 338.396694] ? graph_lock+0x170/0x170 [ 338.400500] ? debug_check_no_locks_freed+0x310/0x310 [ 338.405704] ? __lock_acquire+0x7f5/0x5140 [ 338.409934] ? find_held_lock+0x36/0x1c0 [ 338.413984] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 338.419520] ? _parse_integer+0x13b/0x190 [ 338.423664] ? graph_lock+0x170/0x170 [ 338.427457] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 338.432989] ? _kstrtoull+0x180/0x230 [ 338.436782] ? _parse_integer+0x190/0x190 [ 338.440928] ? graph_lock+0x170/0x170 [ 338.444725] ? lock_release+0xa10/0xa10 [ 338.448703] ? check_same_owner+0x320/0x320 [ 338.453032] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 338.458565] ? should_fail+0x21b/0xbcd [ 338.462466] __alloc_pages_nodemask+0x34e/0xd70 [ 338.467138] ? lock_downgrade+0x8e0/0x8e0 [ 338.471280] ? __alloc_pages_slowpath+0x2d50/0x2d50 [ 338.476296] ? kasan_check_read+0x11/0x20 [ 338.480435] ? rcu_is_watching+0x85/0x140 [ 338.484574] ? find_held_lock+0x36/0x1c0 [ 338.488634] ? check_same_owner+0x320/0x320 [ 338.492941] ? find_held_lock+0x36/0x1c0 [ 338.496998] cache_grow_begin+0x82/0x6e0 [ 338.501063] kmem_cache_alloc+0x689/0x760 [ 338.505209] ? __lock_is_held+0xb5/0x140 [ 338.509261] getname_flags+0xd0/0x5a0 [ 338.513052] do_rmdir+0xe3/0x610 [ 338.516402] ? __ia32_sys_mkdir+0x80/0x80 [ 338.520535] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 338.526068] ? ksys_write+0x1a6/0x250 [ 338.529864] ? __ia32_sys_read+0xb0/0xb0 [ 338.533929] ? do_syscall_64+0x92/0x800 [ 338.537892] __x64_sys_rmdir+0x36/0x40 [ 338.541764] do_syscall_64+0x1b1/0x800 [ 338.545641] ? finish_task_switch+0x1ca/0x840 [ 338.550123] ? syscall_return_slowpath+0x5c0/0x5c0 [ 338.555050] ? syscall_return_slowpath+0x30f/0x5c0 [ 338.559984] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 338.565337] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 338.570192] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 338.575376] RIP: 0033:0x4559f9 [ 338.578546] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 03:36:04 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 338.597730] RSP: 002b:00007faac3413c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 338.605432] RAX: ffffffffffffffda RBX: 00007faac34146d4 RCX: 00000000004559f9 [ 338.612687] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000400 [ 338.619959] RBP: 000000000072bf50 R08: 0000000000000000 R09: 0000000000000000 [ 338.627221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 [ 338.634487] R13: 00000000004c073c R14: 00000000004cff38 R15: 0000000000000001 03:36:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(0xffffffffffffffff, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.699997] binder: BINDER_SET_CONTEXT_MGR already set [ 338.708091] binder: BINDER_SET_CONTEXT_MGR already set [ 338.712811] binder: 20459:20462 ERROR: BC_REGISTER_LOOPER called without request [ 338.722733] binder: BINDER_SET_CONTEXT_MGR already set [ 338.724818] binder: 20457:20464 ioctl 40046207 0 returned -16 [ 338.728218] binder: BINDER_SET_CONTEXT_MGR already set [ 338.735752] binder: 20456:20467 ioctl 40046207 0 returned -16 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.739793] binder: 20461:20463 ioctl 40046207 0 returned -16 [ 338.752365] binder: 20466:20468 ioctl 40046207 0 returned -16 [ 338.765415] binder: 20456:20467 ERROR: BC_REGISTER_LOOPER called without request [ 338.772083] binder: 20466:20468 ERROR: BC_REGISTER_LOOPER called without request [ 338.775501] binder: 20461:20463 ERROR: BC_REGISTER_LOOPER called without request [ 338.790129] binder: send failed reply for transaction 190 to 20456:20467 03:36:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.797352] binder: undelivered TRANSACTION_COMPLETE [ 338.802273] binder: 20459:20462 ioctl c0306201 2000efd0 returned -14 [ 338.802554] binder: undelivered TRANSACTION_ERROR: 29201 [ 338.814270] binder: BINDER_SET_CONTEXT_MGR already set [ 338.820167] binder: 20472:20473 ioctl 40046207 0 returned -16 [ 338.837567] binder: send failed reply for transaction 191 to 20461:20463 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306248, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.872833] binder: 20476:20477 ERROR: BC_REGISTER_LOOPER called without request [ 338.884545] binder: BINDER_SET_CONTEXT_MGR already set [ 338.890239] binder: 20479:20480 ioctl 40046207 0 returned -16 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0045877, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.927645] binder: BINDER_SET_CONTEXT_MGR already set [ 338.933357] binder: 20482:20483 ioctl 40046207 0 returned -16 [ 338.941119] binder: 20482:20483 ioctl c0306248 2000efd0 returned -22 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 338.975499] binder: BINDER_SET_CONTEXT_MGR already set [ 338.981208] binder: 20484:20486 ioctl 40046207 0 returned -16 [ 339.014658] binder: BINDER_SET_CONTEXT_MGR already set 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.020535] binder: 20487:20489 ioctl 40046207 0 returned -16 03:36:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.057393] binder: BINDER_SET_CONTEXT_MGR already set [ 339.065203] binder: 20490:20492 ioctl 40046207 0 returned -16 [ 339.102777] binder: BINDER_SET_CONTEXT_MGR already set [ 339.108804] binder: 20494:20495 ioctl 40046207 0 returned -16 [ 339.526685] binder: undelivered TRANSACTION_COMPLETE [ 339.531965] binder: undelivered TRANSACTION_ERROR: 29189 03:36:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:05 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='//file0\x00') 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:05 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(0xffffffffffffffff, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.802189] binder: 20510:20512 ERROR: BC_REGISTER_LOOPER called without request [ 339.809429] binder: BINDER_SET_CONTEXT_MGR already set [ 339.815338] binder: BINDER_SET_CONTEXT_MGR already set [ 339.820760] binder: BINDER_SET_CONTEXT_MGR already set [ 339.822955] binder: 20508:20516 ioctl 40046207 0 returned -16 [ 339.826398] binder: BINDER_SET_CONTEXT_MGR already set [ 339.833283] binder: 20511:20519 ioctl 40046207 0 returned -16 [ 339.837584] binder: 20518:20522 ioctl 40046207 0 returned -16 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.844915] binder: 20515:20520 ioctl 40046207 0 returned -16 [ 339.854310] binder: 20518:20522 ERROR: BC_REGISTER_LOOPER called without request [ 339.856794] binder: 20508:20516 ERROR: BC_REGISTER_LOOPER called without request [ 339.864582] binder: send failed reply for transaction 194 to 20518:20522 [ 339.878602] binder: 20510:20512 ioctl c0306201 2000efd0 returned -14 [ 339.885252] binder: 20515:20520 ERROR: BC_REGISTER_LOOPER called without request [ 339.895276] binder: release 20508:20516 transaction 195 out, still active 03:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.902454] binder: undelivered TRANSACTION_COMPLETE [ 339.920945] binder: send failed reply for transaction 195, target dead 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 339.962299] binder: 20527:20528 ERROR: BC_REGISTER_LOOPER called without request [ 339.976182] binder: BINDER_SET_CONTEXT_MGR already set [ 339.982381] binder: 20530:20531 ioctl 40046207 0 returned -16 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 340.017670] binder: BINDER_SET_CONTEXT_MGR already set [ 340.023417] binder: 20533:20534 ioctl 40046207 0 returned -16 [ 340.056568] binder: BINDER_SET_CONTEXT_MGR already set 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 340.062476] binder: 20535:20537 ioctl 40046207 0 returned -16 [ 340.069501] binder: 20535:20537 ioctl c0306225 2000efd0 returned -22 [ 340.104710] binder: BINDER_SET_CONTEXT_MGR already set [ 340.110550] binder: 20538:20540 ioctl 40046207 0 returned -16 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 340.117656] binder: 20538:20540 ioctl c0306202 2000efd0 returned -22 [ 340.156506] binder: BINDER_SET_CONTEXT_MGR already set [ 340.162268] binder: 20542:20543 ioctl 40046207 0 returned -16 03:36:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 340.169282] binder: BINDER_SET_CONTEXT_MGR already set [ 340.174875] binder: 20542:20543 ioctl 40046207 2000efd0 returned -16 [ 340.209545] binder: BINDER_SET_CONTEXT_MGR already set [ 340.217193] binder: 20544:20546 ioctl 40046207 0 returned -16 [ 340.650717] binder: undelivered TRANSACTION_COMPLETE [ 340.656008] binder: undelivered TRANSACTION_ERROR: 29201 03:36:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(0xffffffffffffffff, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:07 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:07 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./.ile0\x00') 03:36:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 341.995311] binder: BINDER_SET_CONTEXT_MGR already set [ 342.009480] binder: BINDER_SET_CONTEXT_MGR already set [ 342.016754] binder: BINDER_SET_CONTEXT_MGR already set [ 342.026143] binder: BINDER_SET_CONTEXT_MGR already set [ 342.032500] binder: 20562:20566 ERROR: BC_REGISTER_LOOPER called without request [ 342.046635] binder: 20565:20567 ioctl 40046207 0 returned -16 [ 342.052866] binder: 20563:20568 ioctl 40046207 0 returned -16 [ 342.060615] binder: 20559:20569 ioctl 40046207 0 returned -16 [ 342.070160] binder: 20564:20572 ioctl 40046207 0 returned -16 [ 342.080656] binder: release 20562:20566 transaction 199 out, still active [ 342.087761] binder: undelivered TRANSACTION_COMPLETE [ 342.095046] binder: send failed reply for transaction 199, target dead [ 342.102812] binder: 20562:20566 ioctl c0306201 2000efd0 returned -14 [ 342.112451] binder: 20563:20568 ERROR: BC_REGISTER_LOOPER called without request [ 342.124875] binder: 20564:20572 unknown command 0 [ 342.130437] binder: 20565:20567 ERROR: BC_REGISTER_LOOPER called without request [ 342.137920] binder: 20559:20569 ERROR: BC_REGISTER_LOOPER called without request 03:36:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.138739] binder: 20564:20572 ioctl c0306201 2000efd0 returned -22 [ 342.159544] binder: send failed reply for transaction 200 to 20565:20567 03:36:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7400000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.205154] binder: 20576:20578 ERROR: BC_REGISTER_LOOPER called without request [ 342.209654] binder: BINDER_SET_CONTEXT_MGR already set [ 342.218187] binder: 20579:20580 ioctl 40046207 0 returned -16 [ 342.219328] binder: send failed reply for transaction 202 to 20576:20578 [ 342.225065] binder: 20579:20580 unknown command 0 [ 342.231962] binder: 20576:20578 ioctl c0306201 2000efd0 returned -14 [ 342.236129] binder: 20579:20580 ioctl c0306201 2000efd0 returned -22 03:36:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.270639] binder: BINDER_SET_CONTEXT_MGR already set [ 342.276726] binder: undelivered TRANSACTION_COMPLETE [ 342.282083] binder: undelivered TRANSACTION_ERROR: 29201 [ 342.296321] binder: 20582:20583 ioctl 40046207 0 returned -16 [ 342.304708] binder: 20582:20583 unknown command 0 [ 342.308402] binder: 20585:20586 ERROR: BC_REGISTER_LOOPER called without request 03:36:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x130e0000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.311860] binder: 20582:20583 ioctl c0306201 2000efd0 returned -22 [ 342.320886] binder: send failed reply for transaction 204 to 20585:20586 [ 342.331321] binder: 20585:20586 ioctl c0306201 2000efd0 returned -14 [ 342.357480] binder: undelivered TRANSACTION_COMPLETE [ 342.362787] binder: undelivered TRANSACTION_ERROR: 29201 03:36:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x48, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.372219] binder: 20588:20589 unknown command 0 [ 342.377370] binder: 20588:20589 ioctl c0306201 2000efd0 returned -22 [ 342.391772] binder: BINDER_SET_CONTEXT_MGR already set [ 342.399165] binder: 20590:20591 ioctl 40046207 0 returned -16 [ 342.408182] binder: 20590:20591 ERROR: BC_REGISTER_LOOPER called without request 03:36:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 342.417900] binder: 20590:20591 transaction failed 29189/-22, size 0-0 line 2852 [ 342.436932] binder: 20594:20595 unknown command 0 [ 342.442793] binder: 20594:20595 ioctl c0306201 2000efd0 returned -22 [ 342.480736] binder: 20596:20598 unknown command 0 [ 342.486179] binder: 20596:20598 ioctl c0306201 2000efd0 returned -22 [ 342.817315] binder: undelivered TRANSACTION_COMPLETE [ 342.822591] binder: undelivered TRANSACTION_ERROR: 29189 [ 343.204237] binder: undelivered TRANSACTION_ERROR: 29189 03:36:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0), 0x0, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:09 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='.//ile0\x00') 03:36:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c00000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.296786] binder: 20617:20620 ERROR: BC_REGISTER_LOOPER called without request [ 344.331707] binder: send failed reply for transaction 210 to 20617:20620 [ 344.339495] binder: 20617:20620 ioctl c0306201 2000efd0 returned -14 [ 344.369448] binder: undelivered TRANSACTION_COMPLETE [ 344.374836] binder: undelivered TRANSACTION_ERROR: 29201 [ 344.394406] binder: 20612:20623 ERROR: BC_REGISTER_LOOPER called without request [ 344.436635] binder: send failed reply for transaction 212 to 20612:20623 [ 344.446933] binder: BINDER_SET_CONTEXT_MGR already set [ 344.453137] binder: BINDER_SET_CONTEXT_MGR already set [ 344.459801] binder: 20618:20625 ioctl 40046207 0 returned -16 [ 344.471471] binder: 20614:20626 ioctl 40046207 0 returned -16 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.485729] binder: 20612:20623 ioctl c0306201 2000efd0 returned -14 [ 344.497641] binder: 20614:20626 unknown command 0 [ 344.504357] binder: 20618:20625 ERROR: BC_REGISTER_LOOPER called without request [ 344.512833] binder: BINDER_SET_CONTEXT_MGR already set [ 344.512847] binder: 20614:20626 ioctl c0306201 2000efd0 returned -22 [ 344.525169] binder: BINDER_SET_CONTEXT_MGR already set [ 344.530543] binder: 20616:20630 ioctl 40046207 0 returned -16 03:36:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x5000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.536599] binder: 20628:20629 ioctl 40046207 0 returned -16 [ 344.544006] binder: 20616:20630 ERROR: BC_REGISTER_LOOPER called without request [ 344.551878] binder_alloc: 20612: binder_alloc_buf, no vma [ 344.557662] binder: 20616:20630 transaction failed 29189/-3, size 0-0 line 2967 [ 344.565803] binder: undelivered TRANSACTION_COMPLETE [ 344.567012] binder: 20628:20629 ERROR: BC_REGISTER_LOOPER called without request [ 344.571115] binder: undelivered TRANSACTION_ERROR: 29201 03:36:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.579068] binder: 20628:20629 transaction failed 29189/-22, size 0-0 line 2852 03:36:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.616780] binder: BINDER_SET_CONTEXT_MGR already set [ 344.622327] binder: BINDER_SET_CONTEXT_MGR already set [ 344.622394] binder: 20632:20634 ioctl 40046207 2000efd0 returned -16 [ 344.628337] binder: 20635:20636 ioctl 40046207 0 returned -16 [ 344.647468] binder: 20635:20636 unknown command 0 [ 344.653078] binder: 20635:20636 ioctl c0306201 2000efd0 returned -22 03:36:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.666194] binder: BINDER_SET_CONTEXT_MGR already set [ 344.673220] binder: 20637:20638 ioctl 40046207 2000efd0 returned -16 [ 344.710760] binder: 20640:20641 unknown command 0 [ 344.715819] binder: 20640:20641 ioctl c0306201 2000efd0 returned -22 [ 344.730456] binder: BINDER_SET_CONTEXT_MGR already set [ 344.741290] binder: 20644:20645 ioctl 40046207 0 returned -16 [ 344.752737] binder: BINDER_SET_CONTEXT_MGR already set 03:36:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xe12, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 344.758542] binder: 20644:20645 ioctl 40046207 2000efd0 returned -16 [ 344.778906] binder: 20646:20648 unknown command 0 [ 344.787340] binder: 20646:20648 ioctl c0306201 2000efd0 returned -22 [ 344.809802] binder: BINDER_SET_CONTEXT_MGR already set [ 344.815549] binder: 20650:20651 ioctl 40046207 0 returned -16 [ 344.822705] binder: BINDER_SET_CONTEXT_MGR already set [ 344.828427] binder: 20650:20651 ioctl 40046207 2000efd0 returned -16 [ 345.246184] binder: undelivered TRANSACTION_ERROR: 29189 [ 345.278492] binder: undelivered TRANSACTION_ERROR: 29189 03:36:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:12 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0), 0x0, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c00, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 346.506263] binder: BINDER_SET_CONTEXT_MGR already set [ 346.512341] binder: BINDER_SET_CONTEXT_MGR already set [ 346.518133] binder: BINDER_SET_CONTEXT_MGR already set [ 346.527866] binder: BINDER_SET_CONTEXT_MGR already set [ 346.533623] binder: BINDER_SET_CONTEXT_MGR already set [ 346.535178] binder: 20671:20674 ioctl 40046207 0 returned -16 [ 346.539598] binder: 20669:20673 ioctl 40046207 2000efd0 returned -16 [ 346.547351] binder: 20670:20672 ioctl 40046207 0 returned -16 [ 346.552453] binder: 20675:20677 ioctl 40046207 0 returned -16 [ 346.569484] binder: 20667:20676 ioctl 40046207 0 returned -16 [ 346.577715] binder: 20671:20674 ERROR: BC_REGISTER_LOOPER called without request [ 346.595518] binder: 20670:20672 ERROR: BC_REGISTER_LOOPER called without request 03:36:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.603679] binder: 20667:20676 unknown command 0 [ 346.610673] binder: 20675:20677 ERROR: BC_REGISTER_LOOPER called without request [ 346.615366] binder: 20667:20676 ioctl c0306201 2000efd0 returned -22 [ 346.618842] binder_alloc: 20669: binder_alloc_buf, no vma [ 346.630576] binder_alloc: 20669: binder_alloc_buf, no vma [ 346.630588] binder: 20670:20672 transaction failed 29189/-3, size 0-0 line 2967 03:36:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.666640] binder: BINDER_SET_CONTEXT_MGR already set [ 346.674769] binder: 20671:20674 transaction failed 29189/-3, size 0-0 line 2967 [ 346.687571] binder: 20681:20682 ioctl 40046207 2000efd0 returned -16 03:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.723888] binder: BINDER_SET_CONTEXT_MGR already set 03:36:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.750166] binder: 20684:20685 ioctl 40046207 0 returned -16 [ 346.778731] binder: 20687:20688 ERROR: BC_REGISTER_LOOPER called without request [ 346.788186] binder: BINDER_SET_CONTEXT_MGR already set [ 346.794471] binder: 20684:20685 unknown command 0 03:36:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x500000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.802974] binder: 20684:20685 ioctl c0306201 2000efd0 returned -22 [ 346.810608] binder: 20690:20691 ioctl 40046207 0 returned -16 [ 346.834126] binder: BINDER_SET_CONTEXT_MGR already set [ 346.839698] binder: 20690:20691 ioctl 40046207 2000efd0 returned -16 03:36:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c00000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 346.897985] binder: 20693:20694 unknown command 0 [ 346.907686] binder: 20693:20694 ioctl c0306201 2000efd0 returned -22 [ 346.930469] binder: BINDER_SET_CONTEXT_MGR already set [ 346.936691] binder: 20696:20698 ioctl 40046207 0 returned -16 [ 346.950983] binder: BINDER_SET_CONTEXT_MGR already set [ 346.957833] binder: 20699:20700 ioctl 40046207 2000efd0 returned -16 [ 346.958955] binder: 20696:20698 ERROR: BC_REGISTER_LOOPER called without request [ 346.984189] binder: BINDER_SET_CONTEXT_MGR already set [ 346.998127] binder: 20701:20702 ioctl 40046207 0 returned -16 [ 347.008900] binder: 20701:20702 unknown command 0 [ 347.014440] binder: 20701:20702 ioctl c0306201 2000efd0 returned -22 [ 347.320138] binder: undelivered TRANSACTION_ERROR: 29189 [ 347.337551] binder: undelivered TRANSACTION_ERROR: 29189 03:36:14 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:14 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c65308c") 03:36:14 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0), 0x0, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6800000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 348.788416] binder: 20720:20722 unknown command 0 [ 348.799963] binder: BINDER_SET_CONTEXT_MGR already set [ 348.810490] binder: BINDER_SET_CONTEXT_MGR already set [ 348.819157] binder: 20720:20722 ioctl c0306201 2000efd0 returned -22 [ 348.829807] binder: 20716:20725 ioctl 40046207 0 returned -16 [ 348.838348] binder: 20723:20724 ioctl 40046207 0 returned -16 [ 348.860809] binder: BINDER_SET_CONTEXT_MGR already set [ 348.863908] binder: 20716:20725 ERROR: BC_REGISTER_LOOPER called without request [ 348.878071] binder: 20717:20729 ioctl 40046207 0 returned -16 03:36:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 348.888164] binder: BINDER_SET_CONTEXT_MGR already set [ 348.893181] binder: 20723:20724 ERROR: BC_REGISTER_LOOPER called without request [ 348.893927] binder: 20718:20728 ioctl 40046207 0 returned -16 [ 348.907272] binder: BINDER_SET_CONTEXT_MGR already set [ 348.922733] binder: 20718:20728 ERROR: BC_REGISTER_LOOPER called without request [ 348.929841] binder: 20717:20729 ioctl 40046207 2000efd0 returned -16 03:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) [ 348.941294] binder: 20718:20728 transaction failed 29189/-22, size 0-0 line 2852 [ 348.966431] binder: 20723:20724 transaction failed 29189/-22, size 0-0 line 2852 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) [ 348.987963] binder: 20734:20735 ERROR: BC_REGISTER_LOOPER called without request [ 349.009684] binder: BINDER_SET_CONTEXT_MGR already set [ 349.016297] binder: 20736:20737 ioctl 40046207 0 returned -16 [ 349.023379] binder: 20736:20737 unknown command 0 [ 349.028620] binder: 20736:20737 ioctl c0306201 2000efd0 returned -22 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 349.063481] binder: BINDER_SET_CONTEXT_MGR already set [ 349.069244] binder: 20742:20743 ioctl 40046207 0 returned -16 [ 349.080398] binder: 20742:20743 ERROR: BC_REGISTER_LOOPER called without request 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 349.166923] binder: BINDER_SET_CONTEXT_MGR already set [ 349.172392] binder: 20749:20750 ERROR: BC_REGISTER_LOOPER called without request [ 349.180308] binder: BINDER_SET_CONTEXT_MGR already set [ 349.181184] binder: 20751:20752 ioctl 40046207 0 returned -16 [ 349.187240] binder: send failed reply for transaction 233 to 20749:20750 [ 349.192158] binder: 20754:20755 ioctl 40046207 2000efd0 returned -16 [ 349.199320] binder: 20749:20750 ioctl c0306201 2000efd0 returned -14 [ 349.211512] binder: 20751:20752 unknown command 0 [ 349.216965] binder: 20751:20752 ioctl c0306201 2000efd0 returned -22 [ 349.236309] binder: undelivered TRANSACTION_COMPLETE [ 349.241572] binder: undelivered TRANSACTION_ERROR: 29201 [ 349.606768] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.675769] binder: undelivered TRANSACTION_ERROR: 29189 03:36:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:16 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c653003") 03:36:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x5, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 350.986834] binder: 20770:20772 ERROR: BC_REGISTER_LOOPER called without request [ 350.994695] binder: BINDER_SET_CONTEXT_MGR already set [ 351.006594] binder: BINDER_SET_CONTEXT_MGR already set [ 351.012055] binder: BINDER_SET_CONTEXT_MGR already set [ 351.028882] binder: send failed reply for transaction 235 to 20770:20772 03:36:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 351.031645] binder: 20771:20774 ioctl 40046207 0 returned -16 [ 351.040501] binder: 20768:20779 ioctl 40046207 0 returned -16 [ 351.050215] binder: 20773:20775 ioctl 40046207 0 returned -16 [ 351.052486] binder: 20770:20772 ioctl c0306201 2000efd0 returned -14 [ 351.065107] binder: 20773:20775 unknown command 0 [ 351.075392] binder: 20771:20774 ERROR: BC_REGISTER_LOOPER called without request [ 351.087948] binder: 20768:20779 ERROR: BC_REGISTER_LOOPER called without request [ 351.098392] binder: 20773:20775 ioctl c0306201 2000efd0 returned -22 [ 351.123292] binder: release 20771:20774 transaction 236 out, still active [ 351.130435] binder: undelivered TRANSACTION_COMPLETE 03:36:16 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 351.185578] binder: undelivered TRANSACTION_COMPLETE [ 351.190922] binder: undelivered TRANSACTION_ERROR: 29201 [ 351.198760] binder: send failed reply for transaction 236, target dead [ 351.205582] binder: send failed reply for transaction 237 to 20768:20779 [ 351.218230] binder: 20788:20789 ERROR: BC_REGISTER_LOOPER called without request [ 351.234167] binder: BINDER_SET_CONTEXT_MGR already set [ 351.256878] binder: 20790:20791 ioctl 40046207 0 returned -16 [ 351.263091] binder: BINDER_SET_CONTEXT_MGR already set [ 351.281718] binder: 20790:20791 ERROR: BC_REGISTER_LOOPER called without request [ 351.283752] binder: 20796:20798 ioctl 40046207 0 returned -16 [ 351.291905] binder: release 20790:20791 transaction 240 out, still active 03:36:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xe13, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 351.297077] binder: send failed reply for transaction 239 to 20788:20789 [ 351.302460] binder: undelivered TRANSACTION_COMPLETE [ 351.311689] binder: 20788:20789 ioctl c0306201 2000efd0 returned -14 [ 351.322271] binder: 20796:20798 unknown command 0 [ 351.328191] binder: 20796:20798 ioctl c0306201 2000efd0 returned -22 [ 351.375631] binder: BINDER_SET_CONTEXT_MGR already set [ 351.381317] binder: send failed reply for transaction 240, target dead [ 351.389741] binder: 20803:20805 ERROR: BC_REGISTER_LOOPER called without request [ 351.401749] binder: undelivered TRANSACTION_COMPLETE [ 351.407170] binder: undelivered TRANSACTION_ERROR: 29201 [ 351.415916] binder: BINDER_SET_CONTEXT_MGR already set [ 351.416221] binder: 20800:20802 ioctl 40046207 2000efd0 returned -16 [ 351.426459] binder: 20806:20807 ioctl 40046207 0 returned -16 [ 351.434157] binder: release 20803:20805 transaction 242 out, still active [ 351.441331] binder: undelivered TRANSACTION_COMPLETE [ 351.451505] binder: 20806:20807 unknown command 0 [ 351.460372] binder: 20806:20807 ioctl c0306201 2000efd0 returned -22 [ 351.471269] binder: send failed reply for transaction 242, target dead [ 351.785808] binder: undelivered TRANSACTION_COMPLETE [ 351.791081] binder: undelivered TRANSACTION_ERROR: 29189 03:36:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:18 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:18 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:18 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:36:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x700000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:18 executing program 1 (fault-call:6 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 353.234636] binder: 20822:20823 ERROR: BC_REGISTER_LOOPER called without request [ 353.248812] binder: BINDER_SET_CONTEXT_MGR already set [ 353.261041] binder: BINDER_SET_CONTEXT_MGR already set [ 353.269398] binder: BINDER_SET_CONTEXT_MGR already set [ 353.282325] binder: 20828:20829 ioctl 40046207 0 returned -16 [ 353.288511] binder: 20830:20831 ioctl 40046207 0 returned -16 [ 353.296720] binder: 20824:20832 ioctl 40046207 0 returned -16 [ 353.303697] binder: 20828:20829 unknown command 0 [ 353.308087] binder: 20824:20832 ERROR: BC_REGISTER_LOOPER called without request [ 353.309639] binder: 20828:20829 ioctl c0306201 2000efd0 returned -22 [ 353.316871] binder: 20830:20831 ERROR: BC_REGISTER_LOOPER called without request 03:36:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x48000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) [ 353.331555] binder: send failed reply for transaction 244 to 20824:20832 [ 353.339519] binder: 20822:20823 ioctl c0306201 2000efd0 returned -14 [ 353.346532] binder: BINDER_SET_CONTEXT_MGR already set [ 353.352593] binder: 20825:20833 ioctl 40046207 2000efd0 returned -16 [ 353.354700] binder: undelivered TRANSACTION_COMPLETE [ 353.364414] binder: undelivered TRANSACTION_ERROR: 29201 03:36:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 353.394892] binder: BINDER_SET_CONTEXT_MGR already set [ 353.406528] binder: send failed reply for transaction 245 to 20830:20831 [ 353.425976] binder: 20839:20840 ioctl 40046207 0 returned -16 [ 353.435435] binder: 20839:20840 unknown command 0 03:36:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x120e0000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 353.456708] binder: 20839:20840 ioctl c0306201 2000efd0 returned -22 [ 353.457580] binder: 20842:20844 ERROR: BC_REGISTER_LOOPER called without request [ 353.475387] binder: BINDER_SET_CONTEXT_MGR already set [ 353.491377] binder: 20847:20850 ioctl 40046207 0 returned -16 [ 353.499005] binder: BINDER_SET_CONTEXT_MGR already set 03:36:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 353.506267] binder: 20846:20848 ioctl 40046207 2000efd0 returned -16 [ 353.517951] binder: 20847:20850 ERROR: BC_REGISTER_LOOPER called without request [ 353.518650] binder: BINDER_SET_CONTEXT_MGR already set [ 353.533206] binder: send failed reply for transaction 247 to 20847:20850 [ 353.540159] binder: undelivered TRANSACTION_COMPLETE [ 353.546175] binder: undelivered TRANSACTION_ERROR: 29201 03:36:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) [ 353.549617] binder: 20852:20853 ioctl 40046207 0 returned -16 [ 353.560827] binder: 20842:20844 ioctl c0306201 2000efd0 returned -14 [ 353.569211] binder: 20852:20853 unknown command 0 [ 353.577843] binder: 20852:20853 ioctl c0306201 2000efd0 returned -22 03:36:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x600, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 353.617541] binder: BINDER_SET_CONTEXT_MGR already set [ 353.632114] binder: 20860:20861 ioctl 40046207 0 returned -16 [ 353.668499] binder: 20860:20861 ERROR: BC_REGISTER_LOOPER called without request [ 353.677926] binder: 20860:20861 transaction failed 29189/-22, size 0-0 line 2852 [ 353.685915] binder: 20864:20865 unknown command 0 [ 353.688772] binder: undelivered TRANSACTION_ERROR: 29189 [ 353.697270] binder: 20864:20865 ioctl c0306201 2000efd0 returned -22 [ 354.066144] binder: undelivered TRANSACTION_COMPLETE [ 354.071413] binder: undelivered TRANSACTION_ERROR: 29189 03:36:21 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:21 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 5 (fault-call:9 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306248, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a00, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.512782] binder: 20880:20882 ERROR: BC_REGISTER_LOOPER called without request [ 355.515576] binder: BINDER_SET_CONTEXT_MGR already set [ 355.526581] binder: BINDER_SET_CONTEXT_MGR already set [ 355.539213] binder: BINDER_SET_CONTEXT_MGR already set [ 355.544708] binder: BINDER_SET_CONTEXT_MGR already set [ 355.550678] binder: 20884:20887 ioctl 40046207 0 returned -16 [ 355.551087] binder: 20881:20886 ioctl 40046207 0 returned -16 [ 355.560293] binder: 20878:20879 ioctl 40046207 0 returned -16 [ 355.569448] binder: 20880:20882 ioctl c0306248 2000efd0 returned -22 [ 355.572899] binder: 20888:20889 ioctl 40046207 2000efd0 returned -16 [ 355.585065] binder: 20884:20887 ERROR: BC_REGISTER_LOOPER called without request [ 355.597437] binder: 20881:20886 ERROR: BC_REGISTER_LOOPER called without request 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.605671] binder_alloc: 20880: binder_alloc_buf failed to map pages in userspace, no vma [ 355.605852] binder: 20878:20879 unknown command 0 [ 355.614272] binder: 20884:20887 transaction failed 29189/-3, size 0-0 line 2967 [ 355.628105] binder_alloc: 20880: binder_alloc_buf failed to map pages in userspace, no vma [ 355.636738] binder: 20881:20886 transaction failed 29189/-3, size 0-0 line 2967 [ 355.647849] binder: undelivered TRANSACTION_ERROR: 29189 [ 355.654306] binder: 20878:20879 ioctl c0306201 2000efd0 returned -22 [ 355.720448] binder: BINDER_SET_CONTEXT_MGR already set 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x60, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.742181] binder: 20898:20899 ioctl 40046207 0 returned -16 [ 355.762196] binder: 20898:20899 ERROR: BC_REGISTER_LOOPER called without request 03:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.819318] binder: BINDER_SET_CONTEXT_MGR already set [ 355.838364] binder: 20904:20905 ioctl 40046207 0 returned -16 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4800000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.870688] binder: 20904:20905 unknown command 0 [ 355.886183] binder: 20904:20905 ioctl c0306201 2000efd0 returned -22 [ 355.901803] binder: 20907:20908 ERROR: BC_REGISTER_LOOPER called without request 03:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 355.922677] binder: BINDER_SET_CONTEXT_MGR already set [ 355.934233] binder: BINDER_SET_CONTEXT_MGR already set [ 355.943360] binder: 20910:20911 ioctl 40046207 2000efd0 returned -16 [ 355.950577] binder: 20913:20914 ioctl 40046207 0 returned -16 [ 355.973545] binder: 20913:20914 unknown command 0 [ 355.980629] binder: 20916:20917 ERROR: BC_REGISTER_LOOPER called without request [ 355.986084] binder: 20913:20914 ioctl c0306201 2000efd0 returned -22 [ 355.989892] binder: 20916:20917 ioctl 10 2000efd0 returned -22 [ 356.315208] FAULT_INJECTION: forcing a failure. [ 356.315208] name failslab, interval 1, probability 0, space 0, times 0 [ 356.326754] CPU: 0 PID: 20887 Comm: syz-executor5 Not tainted 4.17.0+ #91 [ 356.333700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 356.343061] Call Trace: [ 356.345671] dump_stack+0x1b9/0x294 [ 356.349320] ? dump_stack_print_info.cold.2+0x52/0x52 [ 356.354523] ? __lock_acquire+0x7f5/0x5140 [ 356.354966] binder: undelivered TRANSACTION_ERROR: 29189 [ 356.358772] should_fail.cold.4+0xa/0x1a [ 356.358791] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 356.358811] ? debug_check_no_locks_freed+0x310/0x310 [ 356.358831] ? debug_check_no_locks_freed+0x310/0x310 [ 356.358845] ? rcu_note_context_switch+0x710/0x710 [ 356.358860] ? do_raw_spin_lock+0xc1/0x200 [ 356.392957] ? find_held_lock+0x36/0x1c0 [ 356.397029] ? apply_subsystem_event_filter+0x3e0/0x1a10 [ 356.402499] ? check_same_owner+0x320/0x320 [ 356.406838] ? rcu_note_context_switch+0x710/0x710 [ 356.411768] __should_failslab+0x124/0x180 [ 356.415991] should_failslab+0x9/0x14 [ 356.419791] kmem_cache_alloc+0x2af/0x760 [ 356.423948] ? find_held_lock+0x36/0x1c0 [ 356.428019] taskstats_exit+0x7d8/0xf00 [ 356.432004] ? taskstats_user_cmd+0x10f0/0x10f0 [ 356.436683] ? kasan_check_read+0x11/0x20 [ 356.440840] ? do_raw_spin_unlock+0x9e/0x2e0 [ 356.445258] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 356.449862] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 356.454905] ? trace_hardirqs_on+0xd/0x10 [ 356.459057] ? _raw_spin_unlock_irq+0x27/0x70 [ 356.463567] ? acct_collect+0x70c/0x860 [ 356.467550] do_exit+0x527/0x2730 [ 356.471012] ? mm_update_next_owner+0x980/0x980 [ 356.475685] ? print_usage_bug+0xc0/0xc0 [ 356.479748] ? debug_check_no_locks_freed+0x310/0x310 [ 356.484938] ? print_usage_bug+0xc0/0xc0 [ 356.489004] ? lock_downgrade+0x8e0/0x8e0 [ 356.493153] ? unlock_page+0x1d0/0x2b0 [ 356.497052] ? graph_lock+0x170/0x170 [ 356.500859] ? debug_check_no_locks_freed+0x310/0x310 [ 356.506061] ? __lock_acquire+0x7f5/0x5140 [ 356.510304] ? print_usage_bug+0xc0/0xc0 [ 356.514377] ? filemap_map_pages+0xcd4/0x1870 [ 356.518875] ? debug_check_no_locks_freed+0x310/0x310 [ 356.524060] ? lock_downgrade+0x8e0/0x8e0 [ 356.528200] ? lock_release+0xa10/0xa10 [ 356.532157] ? check_same_owner+0x320/0x320 [ 356.536470] ? kasan_check_read+0x11/0x20 [ 356.540618] ? __might_sleep+0x95/0x190 [ 356.544579] ? kasan_check_read+0x11/0x20 [ 356.548729] ? _copy_to_user+0xc8/0x110 [ 356.552693] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 356.558233] ? binder_ioctl_write_read.isra.41+0x219/0xaf0 [ 356.563865] ? graph_lock+0x170/0x170 [ 356.567670] ? binder_thread_write+0x2c30/0x2c30 [ 356.572448] ? kasan_check_write+0x14/0x20 [ 356.576687] ? memset+0x31/0x40 [ 356.579989] ? find_held_lock+0x36/0x1c0 [ 356.584061] ? lock_downgrade+0x8e0/0x8e0 [ 356.588230] do_group_exit+0x16f/0x430 [ 356.592125] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 356.596722] ? __ia32_sys_exit+0x50/0x50 [ 356.600797] ? _raw_spin_unlock_irq+0x27/0x70 [ 356.605307] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 356.610337] get_signal+0x886/0x1960 [ 356.614092] ? ptrace_notify+0x130/0x130 [ 356.618161] ? kasan_check_read+0x11/0x20 [ 356.622323] ? rcu_is_watching+0x85/0x140 [ 356.626496] ? rcu_report_qs_rnp+0x790/0x790 [ 356.630946] ? __fget+0x40c/0x650 [ 356.634410] do_signal+0x98/0x2040 [ 356.637962] ? expand_files.part.8+0x9a0/0x9a0 [ 356.642561] ? kasan_check_write+0x14/0x20 [ 356.646826] ? __mutex_unlock_slowpath+0x180/0x8a0 [ 356.651778] ? setup_sigcontext+0x7d0/0x7d0 [ 356.656115] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 356.661325] ? binder_ioctl_write_read.isra.41+0xaf0/0xaf0 [ 356.666964] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.672513] ? do_vfs_ioctl+0x1f2/0x16f0 [ 356.676595] ? ioctl_preallocate+0x2e0/0x2e0 [ 356.681021] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 356.686570] ? exit_to_usermode_loop+0x87/0x310 [ 356.691296] exit_to_usermode_loop+0x28a/0x310 [ 356.695895] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 356.700752] ? ksys_ioctl+0x81/0xd0 [ 356.704485] do_syscall_64+0x6ac/0x800 [ 356.708404] ? finish_task_switch+0x1ca/0x840 [ 356.713759] ? syscall_return_slowpath+0x5c0/0x5c0 [ 356.718698] ? syscall_return_slowpath+0x30f/0x5c0 [ 356.723644] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 356.729026] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 356.733886] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 356.739085] RIP: 0033:0x4559f9 [ 356.742275] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 356.761644] RSP: 002b:00007f5d98dd8c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 356.769359] RAX: fffffffffffffe00 RBX: 00007f5d98dd96d4 RCX: 00000000004559f9 [ 356.776630] RDX: 000000002000efd0 RSI: 00000000c0306201 RDI: 0000000000000014 [ 356.783899] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 356.791167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000016 [ 356.798437] R13: 00000000004bc553 R14: 00000000004ca070 R15: 0000000000000000 03:36:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:30 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:30 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xea03000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 365.576622] binder: BINDER_SET_CONTEXT_MGR already set [ 365.582094] binder: BINDER_SET_CONTEXT_MGR already set [ 365.587469] binder: BINDER_SET_CONTEXT_MGR already set [ 365.596494] binder: 20940:20942 ioctl 40046207 0 returned -16 [ 365.596846] binder: 20933:20934 ioctl 40046207 0 returned -16 [ 365.602525] binder: BINDER_SET_CONTEXT_MGR already set [ 365.609759] binder: 20939:20941 ioctl 40046207 0 returned -16 03:36:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 365.625897] binder: 20940:20942 ERROR: BC_REGISTER_LOOPER called without request [ 365.627989] binder: 20938:20944 ioctl 40046207 0 returned -16 [ 365.642128] binder: 20933:20934 ERROR: BC_REGISTER_LOOPER called without request [ 365.652621] binder: 20939:20941 ERROR: BC_REGISTER_LOOPER called without request [ 365.661878] binder: 20933:20934 ioctl c0306225 2000efd0 returned -22 [ 365.670151] binder: 20938:20944 unknown command 0 03:36:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 365.672653] binder_alloc: 20946: binder_alloc_buf, no vma [ 365.676272] binder: 20938:20944 ioctl c0306201 2000efd0 returned -22 [ 365.680709] binder: 20940:20942 transaction failed 29189/-3, size 0-0 line 2967 [ 365.687306] binder_alloc: 20946: binder_alloc_buf, no vma [ 365.700370] binder: 20939:20941 transaction failed 29189/-3, size 0-0 line 2967 03:36:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x68000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 365.744284] binder: undelivered TRANSACTION_ERROR: 29189 03:36:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 365.819264] binder: BINDER_SET_CONTEXT_MGR already set [ 365.833714] binder: BINDER_SET_CONTEXT_MGR already set [ 365.842814] binder: 20954:20956 ioctl 40046207 0 returned -16 [ 365.849194] binder: 20953:20955 ioctl 40046207 0 returned -16 [ 365.888267] binder: 20954:20956 ERROR: BC_REGISTER_LOOPER called without request [ 365.897877] binder: 20953:20955 unknown command 0 [ 365.908297] binder: 20954:20956 ioctl c0306207 2000efd0 returned -22 [ 365.911904] binder: 20953:20955 ioctl c0306201 2000efd0 returned -22 03:36:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3ea, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 366.228149] binder: 20964:20965 ERROR: BC_REGISTER_LOOPER called without request [ 366.243328] binder: BINDER_SET_CONTEXT_MGR already set [ 366.249253] binder: 20967:20969 ioctl 40046207 0 returned -16 [ 366.251579] binder: 20964:20965 ioctl c0306203 2000efd0 returned -22 [ 366.256485] binder: 20967:20969 unknown command 0 [ 366.261998] binder: BINDER_SET_CONTEXT_MGR already set [ 366.266856] binder: 20967:20969 ioctl c0306201 2000efd0 returned -22 [ 366.277045] binder: 20966:20968 ioctl 40046207 2000efd0 returned -16 [ 366.394721] binder: undelivered TRANSACTION_ERROR: 29189 03:36:36 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 370.555415] binder: BINDER_SET_CONTEXT_MGR already set [ 370.561827] binder: 20987:20989 ERROR: BC_REGISTER_LOOPER called without request [ 370.579500] binder: 20984:20988 ioctl 40046207 2000efd0 returned -16 03:36:36 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0xe1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x100000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 370.702976] binder: BINDER_SET_CONTEXT_MGR already set 03:36:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 370.724233] binder: 20998:21000 ioctl 40046207 0 returned -16 [ 370.750893] binder: BINDER_SET_CONTEXT_MGR already set [ 370.756921] binder: 20986:20995 ERROR: BC_REGISTER_LOOPER called without request [ 370.759379] binder: BINDER_SET_CONTEXT_MGR already set [ 370.770308] binder: 21002:21005 ioctl 40046207 0 returned -16 [ 370.770970] binder: 20998:21000 ERROR: BC_REGISTER_LOOPER called without request [ 370.777494] binder: 21002:21005 unknown command 0 [ 370.787105] binder: 20993:21003 ioctl 40046207 0 returned -16 [ 370.796556] binder: 21002:21005 ioctl c0306201 2000efd0 returned -22 [ 370.802982] binder: send failed reply for transaction 268 to 20986:20995 [ 370.810199] binder: undelivered TRANSACTION_COMPLETE [ 370.815343] binder: undelivered TRANSACTION_ERROR: 29201 03:36:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x300000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306204, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 370.820821] binder: 20986:20995 ioctl c0306201 2000efd0 returned -14 [ 370.825427] binder: BINDER_SET_CONTEXT_MGR already set [ 370.834947] binder: 20993:21003 ERROR: BC_REGISTER_LOOPER called without request [ 370.839963] binder: 21006:21007 ioctl 40046207 2000efd0 returned -16 [ 370.853492] binder: BINDER_SET_CONTEXT_MGR already set [ 370.860735] binder: 21008:21009 ioctl 40046207 0 returned -16 03:36:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 370.884090] binder: 21008:21009 unknown command 0 [ 370.899856] binder: BINDER_SET_CONTEXT_MGR already set [ 370.909517] binder: 21012:21013 ioctl 40046207 0 returned -16 [ 370.910314] binder: send failed reply for transaction 269 to 20993:21003 [ 370.920656] binder: 21012:21013 ERROR: BC_REGISTER_LOOPER called without request 03:36:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x630c}], 0x4e, 0x0, &(0x7f0000000140)="fe413538abb53f38c6330feb376e4a22db2a5e743acd75586bdf79b47df4f5c94e22b229491b28c93234577973d11b513494d924542136ff28786650ba2efae2eada69e00ef8e3aef3c210108b8a"}) 03:36:36 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 370.928842] binder: 21008:21009 ioctl c0306201 2000efd0 returned -22 [ 370.933269] binder: 21012:21013 ioctl c0306204 2000efd0 returned -22 [ 370.945273] binder: undelivered TRANSACTION_COMPLETE [ 370.950544] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.981116] binder: BINDER_SET_CONTEXT_MGR already set [ 370.989698] binder: BINDER_SET_CONTEXT_MGR already set [ 371.008373] binder: 21019:21020 ioctl 40046207 0 returned -16 [ 371.017817] binder: 21018:21022 ioctl 40046207 0 returned -16 [ 371.020206] binder: 21019:21020 ERROR: BC_REGISTER_LOOPER called without request [ 371.046501] binder: 21018:21022 ERROR: BC_REGISTER_LOOPER called without request [ 371.062617] binder: 21018:21022 transaction failed 29189/-22, size 0-0 line 2852 [ 371.086677] binder: undelivered TRANSACTION_ERROR: 29189 03:36:37 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="aacd1bad4700"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c6530ff") 03:36:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4800, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) [ 371.916736] binder: 21037:21047 unknown command 0 [ 371.922006] binder: BINDER_SET_CONTEXT_MGR already set [ 371.928523] binder: BINDER_SET_CONTEXT_MGR already set [ 371.931419] binder: 21037:21047 ioctl c0306201 2000efd0 returned -22 [ 371.937005] binder: BINDER_SET_CONTEXT_MGR already set [ 371.945113] binder: 21038:21039 ioctl 40046207 0 returned -16 [ 371.945935] binder: BINDER_SET_CONTEXT_MGR already set [ 371.953985] binder: 21041:21043 ioctl 40046207 0 returned -16 03:36:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x130e000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 371.957193] binder: 21050:21052 ioctl 40046207 2000efd0 returned -16 [ 371.970193] binder: 21049:21053 ioctl 40046207 0 returned -16 [ 371.973277] binder: 21038:21039 ERROR: BC_REGISTER_LOOPER called without request [ 371.981052] binder: 21041:21043 ERROR: BC_REGISTER_LOOPER called without request [ 371.985127] binder: 21038:21039 ioctl c0306205 2000efd0 returned -22 [ 371.993978] binder: 21049:21053 unknown command -1390686806 03:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 372.015367] binder: 21049:21053 ioctl c0306201 204edfd0 returned -22 [ 372.024835] binder: 21041:21043 transaction failed 29189/-22, size 0-0 line 2852 [ 372.043799] binder: 21049:21053 transaction failed 29189/-22, size 0-0 line 2852 [ 372.047829] binder: 21054:21057 unknown command 0 [ 372.071818] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.077591] binder: BINDER_SET_CONTEXT_MGR already set [ 372.084662] binder: BINDER_SET_CONTEXT_MGR already set [ 372.090218] binder: 21054:21057 ioctl c0306201 2000efd0 returned -22 [ 372.097126] binder: 21061:21062 ioctl 40046207 2000efd0 returned -16 [ 372.097546] binder: 21058:21059 ioctl 40046207 0 returned -16 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:36:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 372.118516] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.149345] binder: 21058:21059 ERROR: BC_REGISTER_LOOPER called without request [ 372.161386] binder: BINDER_SET_CONTEXT_MGR already set [ 372.164053] binder: 21067:21068 ERROR: BC_REGISTER_LOOPER called without request [ 372.179893] binder: BINDER_SET_CONTEXT_MGR already set [ 372.186675] binder: 21063:21066 ioctl 40046207 2000efd0 returned -16 03:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 372.203522] binder: 21070:21071 ioctl 40046207 0 returned -16 [ 372.216168] binder: 21070:21071 unknown command 0 [ 372.229065] binder: 21070:21071 ioctl c0306201 2000efd0 returned -22 [ 372.239778] binder: send failed reply for transaction 277 to 21067:21068 [ 372.250338] binder: undelivered TRANSACTION_COMPLETE [ 372.255683] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.274981] binder: 21073:21074 ERROR: BC_REGISTER_LOOPER called without request [ 372.290146] binder: BINDER_SET_CONTEXT_MGR already set [ 372.304098] binder: 21077:21078 ioctl 40046207 2000efd0 returned -16 03:36:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x8000000000000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:39 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:39 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:39 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:36:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xea03, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 374.111109] binder: 21093:21097 ERROR: BC_REGISTER_LOOPER called without request [ 374.149301] binder_alloc: 21092: binder_alloc_buf, no vma 03:36:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 374.155078] binder: 21093:21097 transaction failed 29189/-3, size 0-0 line 2967 [ 374.196009] binder: 21099:21108 unknown command 0 [ 374.198761] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.201715] binder: BINDER_SET_CONTEXT_MGR already set [ 374.235497] binder: BINDER_SET_CONTEXT_MGR already set 03:36:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b630008b1f2fe967abbe1a753d8b7f3c79169dc"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xd4, r4, 0x400, 0x70bd27, 0x25dfdbff, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000000}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fffffff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback=0x7f000001}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000001}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DEST={0x4, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xd20d}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) 03:36:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xc0ed030000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 374.240220] binder: 21099:21108 ioctl c0306201 2000efd0 returned -22 [ 374.252913] binder: 21094:21105 ioctl 40046207 0 returned -16 [ 374.265867] binder: 21098:21107 ioctl 40046207 0 returned -16 [ 374.271268] binder: 21094:21105 ERROR: BC_REGISTER_LOOPER called without request 03:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 374.311231] binder: 21098:21107 ERROR: BC_REGISTER_LOOPER called without request [ 374.336615] binder: 21114:21115 unknown command 134243083 [ 374.344974] binder: BINDER_SET_CONTEXT_MGR already set [ 374.375465] binder: BINDER_SET_CONTEXT_MGR already set [ 374.376821] binder: 21114:21115 ioctl c0306201 204edfd0 returned -22 [ 374.402589] binder: 21119:21120 ioctl 40046207 0 returned -16 [ 374.411270] binder: 21113:21117 ioctl 40046207 0 returned -16 [ 374.411360] binder: release 21098:21107 transaction 284 out, still active 03:36:40 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:36:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 374.424300] binder: undelivered TRANSACTION_COMPLETE [ 374.430910] binder: 21119:21120 ERROR: BC_REGISTER_LOOPER called without request [ 374.436347] binder: release 21114:21115 transaction 285 out, still active [ 374.444311] binder: 21113:21117 unknown command 0 [ 374.445525] binder: undelivered TRANSACTION_COMPLETE [ 374.467477] binder: BINDER_SET_CONTEXT_MGR already set 03:36:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) [ 374.481887] binder: 21125:21126 ioctl 40046207 0 returned -16 [ 374.486928] binder: 21113:21117 ioctl c0306201 2000efd0 returned -22 [ 374.500306] binder: 21125:21126 ERROR: BC_REGISTER_LOOPER called without request [ 374.537103] binder: release 21125:21126 transaction 286 out, still active [ 374.544206] binder: undelivered TRANSACTION_COMPLETE [ 374.577891] binder: BINDER_SET_CONTEXT_MGR already set [ 374.583615] binder: 21134:21135 ioctl 40046207 2000efd0 returned -16 [ 375.245389] binder: send failed reply for transaction 284, target dead [ 375.252330] binder: send failed reply for transaction 285, target dead [ 375.259070] binder: send failed reply for transaction 286, target dead 03:36:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x0, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:41 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c6530f6") 03:36:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = getpid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) kcmp(r2, r3, 0x7, r0, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:41 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:41 executing program 3: [ 376.372323] binder: 21145:21146 unknown command 0 [ 376.390755] binder: 21145:21146 ioctl c0306201 2000efd0 returned -22 [ 376.398422] binder: BINDER_SET_CONTEXT_MGR already set [ 376.406427] binder: 21147:21157 ioctl 40046207 0 returned -16 [ 376.430213] binder: 21147:21157 ERROR: BC_REGISTER_LOOPER called without request [ 376.455522] binder: 21147:21157 transaction failed 29189/-22, size 0-0 line 2852 03:36:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xea030000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:42 executing program 3: [ 376.477005] binder: 21158:21159 unknown command 0 [ 376.482415] binder: 21158:21159 ioctl c0306201 2000efd0 returned -22 [ 376.492394] binder: undelivered TRANSACTION_ERROR: 29189 03:36:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:42 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:42 executing program 3: [ 376.559345] binder: 21148:21163 ERROR: BC_REGISTER_LOOPER called without request [ 376.584485] binder: BINDER_SET_CONTEXT_MGR already set [ 376.601131] binder: 21166:21167 ioctl 40046207 0 returned -16 03:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:42 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 376.619220] binder: 21166:21167 unknown command 0 [ 376.633141] binder: 21166:21167 ioctl c0306201 2000efd0 returned -22 03:36:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c00, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 376.683525] binder: 21174:21176 ERROR: BC_REGISTER_LOOPER called without request [ 376.733306] binder: BINDER_SET_CONTEXT_MGR already set [ 376.746887] binder: 21181:21182 ioctl 40046207 0 returned -16 [ 376.754574] binder: 21181:21182 unknown command 0 [ 376.759602] binder: 21181:21182 ioctl c0306201 2000efd0 returned -22 03:36:44 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b6398"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x0, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)="2e2f6367726f75702e63707500eac5bea7af575a45fddd5af3a7709295a69e7bc5fd0592bf2a4dc8ace908be8842141ca2a714ed0163d4afd8ac48123d4869e05556a93347d6a7430e03a5f2beb186f16bacf2e4dcdcf3b9ff1d99165ce38d996e7798fe471d9a0d81acd08788fcc9892a2487efcde7a649614b14ba1c18", 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000080)='cpuset.cpu_exclusive\x00', 0x2, 0x0) sendfile(r2, r2, &(0x7f00000000c0), 0x5) 03:36:44 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:44 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:44 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 378.591090] binder: BINDER_SET_CONTEXT_MGR already set [ 378.596852] binder: BINDER_SET_CONTEXT_MGR already set [ 378.597713] binder: 21194:21195 unknown command 9986827 [ 378.624114] binder: 21201:21205 ioctl 40046207 0 returned -16 [ 378.630729] binder: 21200:21204 ioctl 40046207 0 returned -16 03:36:44 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 378.651144] binder: 21200:21204 unknown command 0 [ 378.659260] binder: 21200:21204 ioctl c0306201 2000efd0 returned -22 [ 378.668958] binder: 21194:21195 ioctl c0306201 204edfd0 returned -22 [ 378.680600] binder: 21201:21205 ERROR: BC_REGISTER_LOOPER called without request 03:36:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x74, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:44 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 378.711074] binder: release 21194:21195 transaction 293 out, still active [ 378.718174] binder: undelivered TRANSACTION_COMPLETE 03:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:44 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 378.837268] binder: BINDER_SET_CONTEXT_MGR already set 03:36:44 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 378.861177] binder: BINDER_SET_CONTEXT_MGR already set [ 378.874457] binder: 21222:21224 ioctl 40046207 0 returned -16 [ 378.887262] binder: 21227:21228 ioctl 40046207 0 returned -16 [ 378.899923] binder: 21222:21224 unknown command 0 03:36:44 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 378.911662] binder: 21222:21224 ioctl c0306201 2000efd0 returned -22 [ 378.918422] binder: 21227:21228 ERROR: BC_REGISTER_LOOPER called without request [ 379.376891] binder: send failed reply for transaction 293, target dead 03:36:46 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x200000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:46 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:46 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6a2c8c777fb9d71028df980ff703b08ce0a39662d19396143e0dcebdac1dafc94f29886430549b62521b7df3b22a02ea2ba17a714bb3be599a3308522d61d8aba0bbf7113344aa98eb8ac068f3eb329768bb1c768fb28d73cb7af733db45f620e7f374c784ae3e996421a9d727a83509d6625661aee3f2d0"]}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x82, 0x0) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='@'], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x88, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x28]}}, @transaction={0x40406300, {0x4, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x60, 0x38, &(0x7f0000000300)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @fda={0x66646185, 0x3, 0x2, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f00000002c0), 0x1, 0x2, 0x3f}], &(0x7f0000000380)=[0x78, 0x38, 0x38, 0x38, 0x0, 0x18, 0x0]}}], 0x1, 0xfdfd, &(0x7f0000000200)="ef"}) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0xfffffffffffffe00) 03:36:46 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x0, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(r1) 03:36:46 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 380.829054] binder: 21253:21254 unknown command 2005675114 [ 380.849080] binder: BINDER_SET_CONTEXT_MGR already set [ 380.854510] binder: BINDER_SET_CONTEXT_MGR already set [ 380.866833] binder: 21253:21254 ioctl c0306201 204edfd0 returned -22 03:36:46 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:46 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 380.873800] binder: 21257:21260 ioctl 40046207 0 returned -16 [ 380.888841] binder: 21258:21259 ioctl 40046207 0 returned -16 [ 380.895697] QAT: Invalid ioctl [ 380.905858] binder: 21253:21254 got transaction to invalid handle [ 380.908418] binder: 21257:21260 ERROR: BC_REGISTER_LOOPER called without request [ 380.912539] binder: 21253:21254 transaction failed 29201/-22, size 0-16 line 2852 [ 380.928431] binder: release 21253:21254 transaction 295 out, still active [ 380.935533] binder: undelivered TRANSACTION_COMPLETE [ 380.961781] binder: 21258:21259 unknown command 0 03:36:46 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:46 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 380.975683] binder: 21257:21260 ioctl c0306202 2000efd0 returned -22 [ 380.987710] binder: 21253:21254 ioctl c0306201 20000480 returned -14 [ 380.999182] binder: 21258:21259 ioctl c0306201 2000efd0 returned -22 [ 381.015818] binder: 21253:21254 ioctl 1 20000000 returned -22 03:36:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x20000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:46 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0045877, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="000000d9832a47b84fe04c7872471e6a0000000000"], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x6d6f, 0x400040) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x100, 0x0) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000000180)={0x3, r4}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 381.107792] binder: send failed reply for transaction 295, target dead [ 381.112249] binder: 21276:21277 unknown command 0 [ 381.130885] binder: 21276:21277 ioctl c0306201 2000efd0 returned -22 [ 381.150993] binder: BINDER_SET_CONTEXT_MGR already set [ 381.171560] binder: 21278:21280 ioctl 40046207 0 returned -16 [ 381.205136] binder: 21286:21287 ERROR: BC_REGISTER_LOOPER called without request [ 381.205369] binder: 21278:21280 ERROR: BC_REGISTER_LOOPER called without request [ 381.232708] binder_alloc: 21286: binder_alloc_buf size 2554215420696027696 failed, no address space [ 381.242061] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 381.251088] binder: 21278:21280 transaction failed 29201/-28, size 0-0 line 2967 [ 381.277246] binder: undelivered TRANSACTION_ERROR: 29201 03:36:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:48 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x1, 0x0) syz_kvm_setup_cpu$x86(r2, r1, &(0x7f0000007000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000200)="0f09660ff519642e653e0f01cbbaf80c66b87c9d558b66efbafc0cec0f350f01c86766c7442400819639d36766c7442402d5d6a1276766c744240600000000670f0114242667f466b97401000066b80040000066ba000000000f30dfcb", 0x5d}], 0x1, 0x47, &(0x7f0000000280)=[@efer={0x2, 0x4000}, @dstype0={0x6, 0xa}], 0x2) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x20, 0x2002) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r5 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) ioctl$KDSIGACCEPT(r4, 0x4b4e, 0xd) fallocate(r0, 0x0, 0x3, 0x2) sendto$inet6(r5, &(0x7f0000000040)="1cd280c2a7047ca3c712c62b360f877c99a6411c10033deba40c5e992a14252bfb61ae20f5bf238bd339c90519d5ae1d64d53583", 0x34, 0x800, &(0x7f00000000c0)={0xa, 0x4e20, 0x372c5b57, @local={0xfe, 0x80, [], 0xaa}}, 0x1c) 03:36:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(0xffffffffffffffff) 03:36:48 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 382.991526] binder: 21301:21304 unknown command 0 03:36:48 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 383.012898] binder: 21301:21304 ioctl c0306201 2000efd0 returned -22 03:36:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x60000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 383.086867] binder: 21300:21306 ERROR: BC_REGISTER_LOOPER called without request [ 383.125915] binder: 21300:21306 ioctl 8138ae83 7f5d98dd76f0 returned -22 03:36:48 executing program 6: bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r0, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 383.161616] binder: BINDER_SET_CONTEXT_MGR already set [ 383.175646] binder: release 21300:21306 transaction 302 out, still active [ 383.182789] binder: undelivered TRANSACTION_COMPLETE [ 383.188837] binder: send failed reply for transaction 302, target dead [ 383.207471] binder: 21315:21316 ioctl 40046207 0 returned -16 [ 383.221651] binder: 21300:21306 ioctl c0306201 2000efd0 returned -14 [ 383.232754] binder: 21315:21316 unknown command 0 [ 383.248079] binder: 21315:21316 ioctl c0306201 2000efd0 returned -22 03:36:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:48 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x40001, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 383.265717] binder: BINDER_SET_CONTEXT_MGR already set [ 383.276059] binder: 21298:21311 ioctl 40046207 0 returned -16 [ 383.291495] binder: 21298:21311 ERROR: BC_REGISTER_LOOPER called without request 03:36:48 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 383.381473] binder: 21330:21333 ERROR: BC_REGISTER_LOOPER called without request [ 383.381670] binder: BINDER_SET_CONTEXT_MGR already set [ 383.434201] binder: 21326:21332 ioctl 40046207 0 returned -16 [ 383.459782] binder: 21326:21332 ERROR: BC_REGISTER_LOOPER called without request [ 383.470821] binder: 21326:21332 transaction failed 29189/-22, size 0-0 line 2852 [ 383.481603] binder: undelivered TRANSACTION_ERROR: 29189 03:36:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:50 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) setsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000040)=0x52c3, 0x4) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000200)=[@register_looper={0x630b}], 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:50 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c653002") 03:36:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(0xffffffffffffffff) 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6800, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:50 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc030624c, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 385.304744] binder: 21350:21351 unknown command 0 [ 385.317266] binder: 21350:21351 ioctl c0306201 2000efd0 returned -22 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x68, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 385.406622] binder: 21354:21363 ERROR: BC_REGISTER_LOOPER called without request [ 385.410588] binder: BINDER_SET_CONTEXT_MGR already set 03:36:51 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:51 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 385.448415] binder: BINDER_SET_CONTEXT_MGR already set [ 385.453793] binder: release 21354:21363 transaction 307 out, still active [ 385.460770] binder: undelivered TRANSACTION_COMPLETE [ 385.464740] binder: 21356:21365 ioctl 40046207 0 returned -16 [ 385.466851] binder: send failed reply for transaction 307, target dead [ 385.473104] binder: 21366:21368 ioctl 40046207 0 returned -16 [ 385.491478] binder: 21356:21365 ERROR: BC_REGISTER_LOOPER called without request 03:36:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xffffff7f00000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 385.520846] binder: 21356:21365 ioctl c030624c 2000efd0 returned -22 [ 385.539612] binder: 21366:21368 unknown command 0 [ 385.552017] binder: 21366:21368 ioctl c0306201 2000efd0 returned -22 [ 385.557555] binder: 21354:21363 ioctl c0306201 2000efd0 returned -14 03:36:51 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:51 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="fe63e713", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) socketpair$inet(0x2, 0x7, 0xbf, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x220c0) dup3(r1, r0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 385.630602] binder: BINDER_SET_CONTEXT_MGR already set [ 385.637415] binder: BINDER_SET_CONTEXT_MGR already set [ 385.658653] binder: 21377:21383 ioctl 40046207 0 returned -16 [ 385.667372] binder: 21378:21380 ioctl 40046207 0 returned -16 [ 385.691819] binder: 21389:21390 ERROR: BC_REGISTER_LOOPER called without request [ 385.695841] binder: 21378:21380 ERROR: BC_REGISTER_LOOPER called without request [ 385.718582] binder: 21377:21383 unknown command 0 [ 385.725520] binder: 21389:21390 unknown command 333931518 [ 385.730544] binder: 21377:21383 ioctl c0306201 2000efd0 returned -22 [ 385.735872] binder: 21389:21390 ioctl c0306201 20007000 returned -22 [ 385.746310] binder: BINDER_SET_CONTEXT_MGR already set [ 385.758246] binder: 21378:21380 ioctl 40046207 2000efd0 returned -16 03:36:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, 0xffffffffffffffff, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:53 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:53 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)="2e2f66696c6530ff") 03:36:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={&(0x7f0000000400)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003400)=""/153, 0x99}], 0x1, &(0x7f0000000940)=""/42, 0x2a}, 0x202) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f00000004c0), 0x1000002c0) sendmmsg(r1, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)='#', 0x1}], 0x1}}], 0x1, 0x0) recvfrom(r2, &(0x7f0000000080)=""/174, 0xae, 0x2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x20000000) close(0xffffffffffffffff) 03:36:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x400000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:53 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB='\vc\x00@']}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 387.570905] binder: 21407:21409 unknown command 0 [ 387.570929] binder_alloc: 21407: binder_alloc_buf, no vma [ 387.581457] binder: 21410:21414 transaction failed 29189/-3, size 0-0 line 2967 [ 387.589481] binder: BINDER_SET_CONTEXT_MGR already set [ 387.596457] binder: 21407:21409 ioctl c0306201 2000efd0 returned -22 03:36:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) [ 387.615783] binder: 21408:21411 ioctl 40046207 0 returned -16 03:36:53 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 387.658416] binder: 21408:21411 ERROR: BC_REGISTER_LOOPER called without request 03:36:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x3, 0x0, 0x400, 0x8, 0x9, 0x8, 0x6, 0xffffffffffff1c42, 0x2, 0x8}, 0x10) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x14, 0x0, &(0x7f00000000c0)=[@register_looper={0x630b}, @acquire={0x40046305}, @decrefs={0x40046307}], 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 387.736512] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.770377] binder: 21429:21432 unknown command 0 03:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x200000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) [ 387.786279] binder: 21429:21432 ioctl c0306201 2000efd0 returned -22 [ 387.819883] binder: BINDER_SET_CONTEXT_MGR already set [ 387.840422] binder: BINDER_SET_CONTEXT_MGR already set [ 387.850228] binder: 21439:21440 ioctl 40046207 0 returned -16 [ 387.859690] binder: 21434:21435 ioctl 40046207 0 returned -16 03:36:53 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x300, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 387.884305] binder: 21439:21440 ERROR: BC_REGISTER_LOOPER called without request [ 387.906436] binder: 21434:21435 unknown command 20 [ 387.929282] binder: 21434:21435 ioctl c0306201 204edfd0 returned -22 [ 387.946187] binder: 21439:21440 unknown command 0 [ 387.956712] binder: 21444:21447 unknown command 0 [ 387.978531] binder: 21444:21447 ioctl c0306201 2000efd0 returned -22 [ 387.985406] binder_alloc: 21444: binder_alloc_buf, no vma [ 387.991077] binder: 21434:21435 transaction failed 29189/-3, size 0-0 line 2967 [ 388.000733] binder: 21439:21440 ioctl c0306201 2000efd0 returned -22 [ 388.030110] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.035966] binder: 21434:21435 ERROR: BC_REGISTER_LOOPER called without request [ 388.043945] binder: 21434:21435 Acquire 1 refcount change on invalid ref 0 ret -22 [ 388.051776] binder: 21434:21435 DecRefs 0 refcount change on invalid ref 0 ret -22 03:36:55 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, 0xffffffffffffffff, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:55 executing program 4: r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000f7db7f), 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback=0x7f000001}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") recvmmsg(r0, &(0x7f0000001c80)=[{{&(0x7f00000003c0)=@in6={0x0, 0x0, 0x0, @ipv4}, 0x80, &(0x7f0000000440), 0x0, &(0x7f00000016c0)=""/65, 0x41}}, {{0x0, 0x0, &(0x7f00000018c0), 0x0, &(0x7f0000001900)=""/64, 0x40}}], 0x2, 0x60, 0x0) 03:36:55 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:36:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x9, 0x200000) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={r2, 0x6, 0x1, 0x7, &(0x7f0000000040)=[0x0], 0x1}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB='\vc\x00\b']}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) r5 = mmap$binder(&(0x7f000000f000/0x2000)=nil, 0x2000, 0x1000005, 0x30, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000140)={r5}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:55 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x500, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x600000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:55 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 389.902178] binder: 21466:21470 unknown command 0 [ 389.915172] binder: BINDER_SET_CONTEXT_MGR already set [ 389.927507] binder: 21466:21470 ioctl c0306201 2000efd0 returned -22 [ 389.940825] binder: BINDER_SET_CONTEXT_MGR already set 03:36:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x53, 0x0, 0x6, 0x0, @buffer={0xd, 0x4, &(0x7f0000000040)=""/4}, &(0x7f0000000180)="3c1a016b527d", &(0x7f0000000240)=""/41, 0x0, 0x0, 0x0, &(0x7f0000000280)}) [ 389.948410] binder: 21465:21467 ioctl 40046207 0 returned -16 [ 389.951919] binder: 21472:21475 ioctl 40046207 0 returned -16 [ 389.983803] binder: 21465:21467 unknown command 134243083 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 390.023730] binder: 21465:21467 ioctl c0306201 204edfd0 returned -22 [ 390.058428] binder: 21465:21467 transaction failed 29189/-22, size 0-0 line 2852 03:36:55 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 390.071503] binder: 21472:21475 ERROR: BC_REGISTER_LOOPER called without request [ 390.074880] binder: 21488:21489 unknown command 0 03:36:55 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:36:55 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:55 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 390.116761] binder: undelivered TRANSACTION_ERROR: 29189 [ 390.124609] binder: 21472:21475 unknown command 0 [ 390.124979] binder: 21488:21489 ioctl c0306201 2000efd0 returned -22 [ 390.145865] binder: 21472:21475 ioctl c0306201 2000efd0 returned -22 03:36:57 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, 0xffffffffffffffff, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:36:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a00000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:57 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:36:57 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0b630000c5cfeb0927ccda01bc6e9c8f0f421205b841cb20a0fabf503ac5ffef8020d439f204c5"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x24000, 0x0) ioctl$sock_netrom_TIOCOUTQ(r2, 0x5411, &(0x7f0000000240)) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") get_thread_area(&(0x7f00000000c0)={0x0, 0x20000000, 0x0, 0x2, 0x8000, 0x2, 0x2, 0x2, 0xffffffff00000000, 0xa}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:57 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) r2 = dup2(r1, r1) readlinkat(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000440)=""/189, 0xbd) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000200)=0x5) rmdir(&(0x7f0000000400)='./file0\x00') [ 392.160454] binder: BINDER_SET_CONTEXT_MGR already set [ 392.168442] binder: 21524:21526 unknown command 0 [ 392.179568] binder: BINDER_SET_CONTEXT_MGR already set [ 392.200113] binder: 21524:21526 ioctl c0306201 2000efd0 returned -22 03:36:57 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 392.210528] binder: 21518:21523 ioctl 40046207 0 returned -16 [ 392.228447] binder: 21530:21531 ioctl 40046207 0 returned -16 03:36:57 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 392.254308] binder: 21518:21523 ERROR: BC_REGISTER_LOOPER called without request [ 392.277147] binder: 21530:21531 ERROR: BC_REGISTER_LOOPER called without request 03:36:57 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 392.308149] binder_alloc: 21524: binder_alloc_buf, no vma [ 392.313879] binder: 21518:21523 transaction failed 29189/-3, size 0-0 line 2967 [ 392.342813] binder: 21530:21531 unknown command 0 03:36:57 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:36:58 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 392.370751] binder: 21530:21531 ioctl c0306201 2000efd0 returned -22 [ 392.402614] binder: undelivered TRANSACTION_ERROR: 29189 [ 392.436718] binder: 21546:21547 unknown command 0 03:36:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c00, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:58 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 392.475753] binder: 21546:21547 ioctl c0306201 2000efd0 returned -22 [ 392.514267] binder: BINDER_SET_CONTEXT_MGR already set [ 392.541636] binder: 21555:21556 ioctl 40046207 0 returned -16 [ 392.563328] binder: 21555:21556 ERROR: BC_REGISTER_LOOPER called without request [ 392.582089] binder: 21555:21556 unknown command 0 [ 392.595185] binder: 21555:21556 ioctl c0306201 2000efd0 returned -22 03:36:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x120e000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:59 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)) recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:36:59 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:36:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:59 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:36:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@enter_looper={0x630c}], 0x1fa, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:36:59 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) mkdir(&(0x7f0000000200)='./file0\x00', 0x40) rmdir(&(0x7f0000000400)='./file0\x00') [ 394.357467] binder: 21575:21576 ERROR: BC_REGISTER_LOOPER called without request [ 394.374117] binder: 21575:21576 ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER 03:37:00 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 394.412658] binder: BINDER_SET_CONTEXT_MGR already set [ 394.428525] binder: 21573:21578 ioctl 40046207 0 returned -16 [ 394.445681] binder: 21573:21578 unknown command 0 03:37:00 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 394.458117] binder: 21573:21578 ioctl c0306201 2000efd0 returned -22 03:37:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 394.496163] binder: BINDER_SET_CONTEXT_MGR already set [ 394.514494] binder: 21579:21582 ioctl 40046207 0 returned -16 [ 394.552784] binder: 21579:21582 ERROR: BC_REGISTER_LOOPER called without request 03:37:00 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 394.594094] binder: BINDER_SET_CONTEXT_MGR already set [ 394.603728] binder: 21579:21582 unknown command 0 [ 394.616173] binder: 21579:21582 ioctl c0306201 2000efd0 returned -22 [ 394.625649] binder: 21590:21591 ioctl 40046207 0 returned -16 03:37:00 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:00 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 394.654272] binder: 21590:21591 unknown command 0 03:37:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:00 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 394.698586] binder: 21590:21591 ioctl c0306201 2000efd0 returned -22 03:37:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 394.784181] binder: BINDER_SET_CONTEXT_MGR already set [ 394.817407] binder: 21603:21606 ioctl 40046207 0 returned -16 [ 394.836303] binder: 21603:21606 ERROR: BC_REGISTER_LOOPER called without request [ 394.849387] binder: 21603:21606 unknown command 0 [ 394.859442] binder: 21603:21606 ioctl c0306201 2000efd0 returned -22 03:37:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:02 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xc0ed0300, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:02 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x100000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:02 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x291, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:02 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) r1 = syz_open_dev$random(&(0x7f0000000080)='/dev/random\x00', 0x0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) preadv(r1, &(0x7f0000000000)=[{&(0x7f0000000180)=""/177, 0xb1}], 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{0x0, 0x1c9c380}, {0x0, r3+30000000}}, &(0x7f0000000400)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r2, 0x1000000000016) r4 = accept$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, @loopback}, &(0x7f0000000480)=0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x4}}}, &(0x7f0000000580)=0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f00000005c0)={0x8, 0x4, 0x5, 0xfff, r5}, &(0x7f0000000600)=0x10) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000640)={r6, 0x701}, 0x8) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 396.969600] binder: BINDER_SET_CONTEXT_MGR already set [ 396.978944] binder: 21632:21633 ERROR: BC_REGISTER_LOOPER called without request [ 396.989322] binder: BINDER_SET_CONTEXT_MGR already set [ 396.994894] binder: 21624:21630 ioctl 40046207 0 returned -16 [ 397.004256] binder: 21626:21631 ioctl 40046207 0 returned -16 [ 397.013557] binder: 21624:21630 unknown command 0 03:37:02 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:02 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:02 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 397.018651] binder: 21632:21633 unknown command 0 [ 397.024095] binder: 21624:21630 ioctl c0306201 2000efd0 returned -22 [ 397.025689] binder: 21632:21633 ioctl c0306201 20007000 returned -22 [ 397.033889] binder: 21626:21631 ERROR: BC_REGISTER_LOOPER called without request [ 397.051712] binder: 21626:21631 unknown command 0 [ 397.057218] binder: 21626:21631 ioctl c0306201 2000efd0 returned -22 03:37:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x130e, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x700000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:02 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:02 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:02 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 397.188784] binder: BINDER_SET_CONTEXT_MGR already set [ 397.218813] binder: BINDER_SET_CONTEXT_MGR already set [ 397.268162] binder: 21655:21656 ioctl 40046207 0 returned -16 [ 397.274179] binder: 21650:21651 ioctl 40046207 0 returned -16 [ 397.295500] binder: 21655:21656 unknown command 0 [ 397.312258] binder: 21650:21651 ERROR: BC_REGISTER_LOOPER called without request [ 397.313785] binder: 21655:21656 ioctl c0306201 2000efd0 returned -22 [ 397.325064] binder: 21650:21651 unknown command 0 [ 397.339018] binder: 21650:21651 ioctl c0306201 2000efd0 returned -22 03:37:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:03 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:03 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:03 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x48000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xffffff7f, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB="0bf2d700"]}) ioctl$FICLONE(r0, 0x40049409, r0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) setitimer(0x3, &(0x7f0000000300)={{r2, r3/1000+30000}, {r4, r5/1000+30000}}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r6 = socket$inet6(0xa, 0x1, 0x1) r7 = syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x980) bind$pptp(r7, &(0x7f0000000240)={0x18, 0x2, {0x2, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1e) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x3c, 0x0, &(0x7f0000000040)=[@dead_binder_done={0x40086310}, @release={0x40046306, 0x2}, @increfs_done={0x40106308, r8}, @register_looper={0x630b}, @request_death={0x400c630e, 0x2, 0x2}], 0x7a, 0x0, &(0x7f0000000140)="8805843f8848ca9a9bf4758b188fe915ece46a6133fa89d7d53f28c1d078a53590c5e1de448bb3ee571b47af1430dc506791d5f9496377ac62cfe9905b97f77f17fc06e317444b4265e9cf0ea882cf0ae293addbba43d2b6418f8cef1d0c9818d035ea315b08f0740a9737fd4576f8e4346011d88b22856e75bf"}) ioctl(r6, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r9 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) 03:37:03 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000005c0)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0}, &(0x7f0000000640)=0xc) fstat(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = fcntl$getown(r0, 0x9) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000700)={{{@in6=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000800)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000840)={0x0, 0x0, 0x0}, &(0x7f0000000880)=0xc) r8 = fcntl$getown(r1, 0x9) lstat(&(0x7f0000000c40)='./file0\x00', &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getegid() fcntl$getownex(r0, 0x10, &(0x7f0000000d00)={0x0, 0x0}) fstat(r1, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000dc0)={0x0, 0x0, 0x0}, &(0x7f0000000e00)=0xc) r14 = getpgid(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000e40)={0x0, 0x0}, &(0x7f0000000e80)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000ec0)={0x0, 0x0, 0x0}, &(0x7f0000000f00)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002280)={0x0}, &(0x7f00000022c0)=0xc) getresuid(&(0x7f0000002300), &(0x7f0000002480), &(0x7f00000024c0)=0x0) getgroups(0x3, &(0x7f0000002500)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff]) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000004780)=0x0) fstat(r1, &(0x7f00000047c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000004840)='./file0/file0\x00', &(0x7f0000004880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000004900)=0x0) r24 = geteuid() r25 = getegid() r26 = gettid() getresuid(&(0x7f0000004b80), &(0x7f0000004980)=0x0, &(0x7f0000008880)) getgroups(0x6, &(0x7f0000004a00)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000004a40)=0x0) socketpair(0x11, 0x800, 0x1, &(0x7f0000001800)) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f0000005080)) recvmmsg(r1, &(0x7f0000008680)=[{{&(0x7f00000050c0)=@nl, 0x80, &(0x7f0000005540)=[{&(0x7f0000005140)=""/144, 0x90}, {&(0x7f0000005200)=""/232, 0xe8}, {&(0x7f0000005300)=""/208, 0xd0}, {&(0x7f0000005400)=""/112, 0x70}, {&(0x7f0000005480)=""/162, 0xa2}], 0x5, &(0x7f00000055c0)=""/73, 0x49, 0x1}, 0x1}, {{&(0x7f0000005640)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast2}}}, 0x80, &(0x7f00000058c0)=[{&(0x7f00000056c0)=""/129, 0x81}, {&(0x7f0000005780)=""/67, 0x43}, {&(0x7f0000005800)=""/137, 0x89}], 0x3, &(0x7f0000005900)=""/154, 0x9a, 0x20}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000005c40)=[{&(0x7f00000059c0)=""/168, 0xa8}, {&(0x7f0000005a80)=""/88, 0x58}, {&(0x7f0000005b00)=""/11, 0xb}, {&(0x7f0000005b40)=""/228, 0xe4}], 0x4, 0x0, 0x0, 0x54c}, 0x12}, {{&(0x7f0000005c80)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000007000)=[{&(0x7f0000005d00)=""/148, 0x94}, {&(0x7f0000005dc0)=""/192, 0xc0}, {&(0x7f0000005e80)=""/183, 0xb7}, {&(0x7f0000005f40)=""/177, 0xb1}, {&(0x7f0000006000)=""/4096, 0x1000}], 0x5, 0x0, 0x0, 0x4}, 0x7}, {{&(0x7f0000007080)=@nfc_llcp, 0x80, &(0x7f0000008100)=[{&(0x7f0000007100)=""/4096, 0x1000}], 0x1, &(0x7f0000008140)=""/163, 0xa3, 0x4}, 0x2}, {{&(0x7f0000008200)=@hci, 0x80, &(0x7f0000008600)=[{&(0x7f0000008280)=""/247, 0xf7}, {&(0x7f0000008380)=""/124, 0x7c}, {&(0x7f0000008400)=""/184, 0xb8}, {&(0x7f00000084c0)=""/202, 0xca}, {&(0x7f00000085c0)=""/61, 0x3d}], 0x5, 0x0, 0x0, 0x64}, 0x7}], 0x6, 0x0, &(0x7f0000008800)={0x77359400}) getsockopt$inet_IP_IPSEC_POLICY(r30, 0x0, 0x10, &(0x7f0000004a80)={{{@in6=@ipv4={[], [], @multicast2}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@mcast1}}, &(0x7f0000005040)=0xe8) fstat(r1, &(0x7f0000004bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000004c40)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c80)={{{@in=@broadcast, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000004d80)=0xe8) r35 = getegid() sendmmsg$unix(r1, &(0x7f0000004ec0)=[{&(0x7f0000000380)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000440)="11fa67e0616af5a0f4987dac4397f679be8f9560d66e8fdc6878b232ca7fcff4b1aaf88934b13eed06d3f992e79b4968ec0c263f348006b1cd911a18c3efc9f42b9ba338d24741e66b5bee44928bb6", 0x4f}, {&(0x7f0000000100)="a0135c22ff6e9fd6af6b6a38f3d0af7bb52aadc1167e8c94", 0x18}, {&(0x7f00000004c0)="8c6b48fad2d41b7fbd49a59cbffae6512d037ed668aaeaede45bc739b2389f73900160ad6eb3f8d50df910ed8345087a6c58ffb6507db0068e0d8fa992149e29c17681f54347105eb3aa380a62a658f68dcfb41a1a8feb98234e0379013264d06eba87592649cc654dfd315b528b64cbc21b7c538eb8f22d1abf74b15eb661e1bd979cf946e674c4f9609a5e4dfb96a6af23541606", 0x95}, {&(0x7f0000000200)="381b2c152eca9d6930f197eda913b4a9d18fb29ae3eaab34687bcfe9ed6ecc812d8eac44cca491deaf57f8bdedcb2c", 0x2f}], 0x4, &(0x7f0000000900)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x28, 0x1, 0x1, [r1, r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0]}, @rights={0x28, 0x1, 0x1, [r1, r1, r0, r1, r1, r1]}, @rights={0x20, 0x1, 0x1, [r1, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0xc8}, {&(0x7f0000000a00)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000c00)=[{&(0x7f0000000a80)="8e36b105ab20854231cce83c3161259d5a29c7578b39292ee4269def17196d35a1ad79cec016339faaa5846fceb61726f8a54d2350d849fe81df9a7f638fdd846979e873ba1cc6a0b90d07681700e91e3a086c1639ecbd5660df2caa28a7a62150488df7dbfe73f570bb86becb745889d426", 0x72}, {&(0x7f0000000b00)="523d9bb7e4fdabe4d83fc8db503f5e03d618241dfc30ee09e555b4915b85a378aeafec4bbfdb3d999bb39c6d43f2d78b23262b09d9ca4347659fbc61b8fd31cfa031088490038b684e150439efd94169bf72fdc78aea0572b944b9e05911570715798c8cae482568ba21437e15c07c094507f400259ed162bdae3ba9c2734af2267089e0ab4af0c0acc7975f5a79f895c7ef4401a0480be840557e9d8e0ef4fbaa47df802983faecbb07cad088480d231ec5eb62cd57b69f50c487202d76ba72deae9979a82412dc6e850694d7fe345bb3f96a5e9caba1", 0xd7}], 0x2, &(0x7f0000000f40)=[@cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x30, 0x1, 0x1, [r0, r1, r1, r1, r1, r0, r0]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @rights={0x20, 0x1, 0x1, [r1, r1, r1]}], 0xb0, 0x40000}, {&(0x7f0000001000)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f0000001300)=[{&(0x7f0000001080)="e0318c05e3661b9a0af3d291fbc16d70a4eb54c847746382e03974666049b41669ce753f7aad9459484197296b7aa660d7a479bba5ec1f4388da3a", 0x3b}, {&(0x7f00000010c0)="36d0340b79188f872ca588a536732b66063a33a269b560a367", 0x19}, {&(0x7f0000001100)="640d8ccd4e523a0e81e715c045d330b38f9bef9d8aae93e0e6e70efd9dbd5de8aa78ff30dd09c5522a55e0abafa514206d1edd1aa3fbbdc9cb615c46ced8b33107b139e1eccc3942cf75a2d12ab7f542e0d315582065009fb66e9d678456a15dd7fba5deab4c585246", 0x69}, {&(0x7f0000001180)="c925914196021c31b4451ed25e56ef293988f3db64d41f2dbb0bf7124719977a2daad9bc4a33db68e09af57b2d671799a30c5d8899fd8193c400118889dce2af8cbdde1bb025ba970e2433c3ee173170ea09b97e3fb70724c19ae1172202ff70f840f52450cda015b100fcfc5183acc04ccb9ed4c063220bda70d11a62c28fa2aa8b461e27c719dec5b1674bd56dfa5359f9479ea24f3020799e204af414fc7a0c68b8e063f51355b13608747d8d97a892c98ada24b3", 0xb6}, {&(0x7f0000001240)="c100475ccf89a85a59f0c42de7c855c3eff18ad05db184cfd840769559210d67e903e4503b675a705041782093b1313433cda8d3031358beb0", 0x39}, {&(0x7f0000001280)="7ce0a4ae2bccf7702988c0e4e558d963043ad77f1fb8bb1ad15fe71dfbea24d88aabf49fc8d2c54677a584ebb856cc33b85bd0cdcfc89228292dc0236aa5e9c38caa3aed0cb6c7cd", 0x48}], 0x6, 0x0, 0x0, 0x40000}, {&(0x7f0000001380)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001780)=[{&(0x7f0000002580)="663b308b9a57e3f0f509e2b6023e805251a505499d6747a9a9a7ede45f6bab04d4f8dc7393c39310c7ced19ed98290e2868742c4a299c141d6f1a6e598a16450eda22428eba5742d889fb4f4c12b593949d7a32c06f9ff36c014e1a99621c11b3b0c91eedf69c4c180cb3bc19d6979b6fbeb1ede4c02d7233f5ee423654adda53ba6a83373036400460f07b6c2029edd26c2bedbd6ca145704e5fe3a8f9538cdef3d18f3a41dba13b818e284a03eff828607b755ea2818048325fc0b7c944bb57a8b510f6fcfe18315374caeb3d6affdc1806cfbb5c7c8aa9039f9f7c9d1b96cce830f4307e131862f7f65c00c0aaebb95cb6bf8a363f5945cde066c7d4f462d1cc76d2db8bbbc5386d0946bd43e35695dbf8e76885020098236a0e4d333f2c67023045b38c6a0cf9c850bc2038c27b7fbe640f60a0ef13eea8319047a42632bd702b4a9dc3b3dce9f5e8aa3662b656461752b000a9a32320ca44fd9ae593a7d6c0cc5ba5e77e308ef3f5499b1bae35bfd522e93ee4f6105b6a41b0961b31b7ab3f83ca28a0c4fa2c1141f484570254e7656086bc215adef476436cfcfa0c84f4471972cd52a230e9ea3884d6baf0fd7ee3a312cef1e2922cc987bd897f6f0358bfa8544ec93bae28f5d4ab0c0b5554cfdd65adbb8c929d147421e150477c6a08891de1e8084a0092125921b0430babc501fbe779d773272ff4f1316f1413e7b6468cf7e516213eaddd9beaa1ba91c3e9e464f2d119e1395b68a0b6beaf4f6f1842f1f7593833b45e20ce294849b06b80ce8c88846f11d6d0354e0dc90d255b9e02514011974b3da01772e53f287f92af84e4bd2feaa6b6c05333723fb243ccca09201c558ee8b283bee5a51172fab8b2372566322a5208db0dd23b3055cbfb754d9c5c256816028d38843f58bf295a101f6bcdf3c4c4e259367f9b7e9a9c112f09b7ef3113743368ffb58f8fa29d91226e79e9e26d560e322804d1f6f2ccb4ae37f291195b3dfaaee075a194111adeb20aad8d146c4b6fa407481b0fb9d5b91f2a609cede1cc96fe14ef9e018a254ec62476cb4e895dca4ee1f6021b13dfeaafa68126294588bea8ae2d4b454f0c4c4831bbebaa76966960fdae53b3e665e96c9f056befcf32128cc0239bf4199f1b772f02bd43d5c2ecc7edb04ac663e07d43b1c2bcf6a77784ded6814ece63e8eea854b1db8640e0910b808e4aba339b515f2657c048dbafdf13d999e0c61318e9a8c2e08891678f70d5fdcd32e850af51caf27cd8e2ac374bc12bba0273f2c14ba9e94cfd0d047bf4babed8dbe37ef1d6da3b6a0981b791bed841e0b60e34f0e23871b9c898e43694fdadfd4075234a7461feca2fc160ade5022761afed95387c89c12121760f6b9964f0a10bbcc5c8c61e35c4c63de9566780e60bcc62120ebd1e7fb11cbe48c0c11d4181ec980e0f1995efa7342de0ca37b48776dcbd1c014ece42b940280be7b578306ba6cab44264fbf085fab4d624bf5f45a8aa5f094b35b6c24cb0e8825c5686beb173d36083a7948500fac59dd654ff211f609dd21fb58f4fa93c9479cea779d007f062d24baf25354ca6e1a77f8e7ea77b3ff54bf77535b41928ea2a050b47c49048900582212caaba49c0d52beda1a417057c98bc3010478b0148048307811f29730fa95e6f4dfb396e9448421c1c2d9418045301916bcef889f4386e62121bb420685201cafb589e1f4781a6ca53e3531ec36fec0cab87550c4a136978e2d462a205b990adba161d56999c11f8c1f93ff9cad62fe8d579f3c89b02cbbf9e00817a570e332dc6d65ef220227c29c0c2c1018f25af31880fc999a173fefc6fb9596ddf79c0af86c0d3c2ab660696a5edd20fb7e583046fa98daa66f045d8c69750b85434c25a50176f3a92a5295a6b765cb2fdf8bf49dc0b505f7413582546f5233a746dccbf5c0075c2822d287755971b4d4f6f1e93d0e110e72d8800e08c1cfb2f266b3564143b1008f81c3c91db7b6084623f10f9403f580e2f83b1f3cb51eeed696d160ff1e30471b8cf8951de125df7d6f89806b40fd6bfaf74e94dacaa785e4b9fa450c7b38f31659417824bac0c7a33813baa8ddbe12f86d7027cb811163b7f72b1a6ff286047b8716f3a949ce6e6a4c6f53a9707132a5b1590dca7aac51378bcbcfa144f7385702cc193f18eb68fbf57e06baf809ef7e666c779d7be133634d9aa1120423f9afa4f58f123c169470307f64a60b7e259d216ff7b9746f99ec580ab913a347fcb83cd57c6bec253c2ca62f1e0ca11242d735366369bed52e4b10d124529834f7e303e5b0cbcbdd1e04675bc8b0215509dde79d2a0a7c13de5f181c41a9466dbc5cd4247602634c75a386190fc3660fbf89b5472b3408cff33f4e5d6b58e412a2dabf5e8b114dac27cbf8912a54f9b1fa8fb77670321d602b0ca22a7cd3c00a6c8572f0367f517da6daa4314da14e0ec796b6aaf5f56dbf49c8fb5a268454825b1f4b2b4a410df1692d42ba2d1fe7a39a84c3b88f049ce1fe69ff3363335c065a7629d31bd0a4bb2c9667a5e18c91cd977cdde9ed3bfb5af2ed1b112dbc43d9fe6798d211b6d2adce6a610d65598855e79be63c84bd596636ef093b5b0608e0e8be5f40fc164c740c474e579811b3dfd0ade4f7cf5c7304cbac0fd80b8b72903545fff8d27096cfee21a604e9a54f32cf0e23f3abac6162ba16a0715434be5d7fc03e500789e89c0f5cb848633c4121132c6031b1df786ed2b9efabbf103959b9eadc4aede39ad3fed3ca42fb2c0de909e41042b2fb6480536ea7c386ea5b56da1c623eeccaa4d23422fe8c678ae5ce7c450680f9f84f036f0d8dfa7391524f9e485980c8acab76056cba0bef297ad564545b6a67ff60fbc8ffffa3ba4b4f2fbe277d59d571297b5f6ef37f9ea331c70152c5beade5772a9fe691adb15dc484e3f0bd560ea8fbc3fd2a00d5ba0b7a56d26bd7bf9e92c73564c5957c7d57e08dd06fb2d9e6cd8bc8d0825e5de4cc783a8599176c0b76c39eab97121ef9dc09ec36d379fe37e747dcffc12a16930394610e9bb177954e51ca323cbb4717eec848e17304b206e8c2f5d3ea9505185fb3e3fba12f35097cf981896867725c06833ed95001dc9d9e05b49b78e80db860237b30ee203fb4acb9c81f0fa4ef95936105cd0dc9c10d7ed88285bbca7073a7406533c1b98c4968de83324d3f4035aef8a22b51697c835c44c5a7f6279cbed9a112d8539085b5d07b9eb654ca2564d33c1daf24b2e77bb5ab88c6c09129f7b4fd4abe769ded8bf3d1558801986f535fae9e4d7343fb3efe631e044418de4f006b8b1a9a9bb24b7c67448bf985275a0e8dd5751d962101ab833163a780c29b64fb7b11932742dd82af8931d0b6c29140d3d2b1af6c333caf31f035133df4aa8aa9a06814bc673932413ac91bd358d2d7dd92c8a66ec22d68fb1f34934920a19f43b0e4c8b0886f5f4ff8e4dd26f10c20409ba15ae12c4c56f005c8d8bfff840fe653ebbe48d03811a3d160ab51f4992af158c12fe7f3af4a7ca7e9c5138e94e4c53013f101756d6ee19299252d1ea53105c0257212c1163105eee0ea96a27c77cf0cce8b831b5cfccb167e96a2e6adf8325afcb49e7d694fa47a728096c55271bd4601bf6664e2e036fff66e841813530ad76621b58ab830c50677878d00fa382e2be354f43cf38d02d22b923f8b70a24f0ad4741a645ff7f26cb145057451d5e4f229d188fe2162a64c31624a3a0deb93b9a28fecfdb307fd0ef824505466c308d424766e1918b4d9d1d6c6c1ef516f0f8c91266bcb0f34f63f65caf08d634c2db0fea0660c54f59d5fe5c90fc678812c132096a19656fa28207b433a0abd845bc634b9c7eca20ff59c9ddbf6b9dc8dfc1c2765bd7fb880eda3938bc1e4f82d8cfff472a67d410115aee3a50d2b7c5c2da7a418a3075d3063b47d2e2b467e5915016155a71c3e0fb28e56475cf2a9ffb5a85cd06821b961b1668f67a45a47d17463491df4522a2217c48a166f2c59b4768b53ca8074e3bb63bbbbc0def7c054b83e9920aefef396b4f854b6c7c2aef3db597d4dd078993852aac9522ffd6511b4275d65facf35da96a8c17b6b69488df29316dcb904b4cdea6d0dc28b42ee0a3552303f7d78f1845c860f9094a3b4146156486772ac187bd2de16efa510efbdfb2a272dd8b74776798239eaf14b9cf122a3cd94c268b8d8260107658cab2b73fc3ea748d97f19058459f03105cc4b90560c75a1ec039bd4ff2ab0dacfa143852e6431e3ccf6b2fabbb7be66e393bcd6c055a66334d4e53d2149422dc6aecabf0d126f54a01367ac294891a4203767bef4b65c4281f4732f147b661647e0028f53a167a4a1a0325c331111e05c3d85382a35933011a49da6c9018a9ea504101ee48a7c5440eee2c44efce1e9df8429c614deb0abe2c42ff88494e2ea59433a7effa9e400682d74644fd0416b39ddf5986bb1dcfce2631ed95508295741bedb06d3f3537c419be4eacce1db91db9f95f9e29b73e5ca35a9b78bd40d9d908fdce24044aa3da466391b4efe71557b15b23ec7d09e419138ae3ae32ac73f5e432080e34c745592e3cb5f24576351a09a96bf2d9ece94458c8617137c7e40866b8f53657b83e4bb05b775a6d6f071ca21115212bf8b9cafdc2ba8392081aff347e0e986bef50d7089c9839d061352f43e30f7d32da911ebf70e8fcca48cccaedebcc2842970232e240368cbb2565dcf236effac7a062424592120ffc69cd3c5546b12381ea73aae52a6b355ada797c921603ec689a3205c9d1e4679cc2b0c2f5ddd3ec7753358c720d3e286dbdb3fdd0243f0275c794c21218f25cade38e5c680ae69fcb4ced14f0d85369edf1f99839a72529127bed3f0245747a688a2ba899bf34e377bbc22e3bdcc5dafdf8ad4603f82b73bbd917bb53d9f8cc51750a053e027676625359810c61244e2a4a633a8a7d01314f9282e5946b0b6cc311aee938fa5cc125dde4b0d3610e39d230d13e43a80f0aaade3f691d4808a54bdc59682b9de0d7c39ed6353f652a52a730a73fa9039038c5453b7762861ef84a46ca0fd20b12c367b75829005fc93e9bcd69198fa6f12cffacb5d27caf802927b8c26ff13a99c64dd5ed31bd653dcd8be2c8067812b2c67df82dc0e9390c7fd97db6d4594e16d5036de4434c349478f0a704b44961bd2f524b7b44c3a4fe85dedf22220e09197918e001aed547ec237dcbf94234bb9d89e8fe5df75edb34f38287dc49d94b957dd0e7bfec1d3e9a5438771813fb261072ce7279ee613b550f191c9e3189abd81611fbdfaa82aa1ee5d06838a7e49799318432118fc2fa0684d0cfce7f284ada307677669c93e317d97a8c2f68e298887688642a880b6ee9cb7aac09da2c01cc03554ea875dcbefcf88c51340ab35f8a6dd1b7b7e9c023036cff2b269b61b101c4f01aae59b41878547e7f60d3a94dfdfcb040fba0e171c100f67fd5dfd284dd48e53df8662df409fd983ed56471165bb5cef7a0daf477f8dfc596d20c8476ab2eb5decf265d7172dce11eacfab768bb59bf947c93b425316ec1bd71e290059a0fc6647e5d84fa31a9ab44bc2468fdf3d1198b225740e757e89d4af84e98e5df1f746c993321ca009fddfbf47e5fed37fe0802fd79ce01962716e94a1df1cf1297c5f3feebebaf53c2ccdd1a7e65c8ae4dddb6cdf1c37506ccd95ec490a2cb37548e714702581653e476ca6808164d63fcac63a678e2085d7053a634c918178c00324a826664d139d7b417f21dc257858", 0x1000}, {&(0x7f0000001400)="d0a0c5fc57b5e7d9666621d39d5fcb13b48b44ae4613db75265b10862f2416782f042c4bf754b762d6899ce061f13caa4f1cf11ffab9331c7be1987d19f8827149705ae369945d9e197010261ee2f54952cd0402ecaa0007cd68b0014bf7063e15621ac6c69cd23ab1e8ef5da2c230107cd8ce38d53cd3c3ad6f189913289bc7c36fb0d152369627da4bd5ef2c431b706ccefbc7eb4d3cb655160514bbc5d07922d727c3e39da0d84d05dbc76c24b5bec4639be528a96ce1b9d938fbefe74d34148c290da2522a", 0xc7}, {&(0x7f0000003580)="f18777f31c72def659349afa88488c2a0f95c40552042dc78a5dd9d09e66c53144153bbbb34d46c4fc3a77c6c85f77bca2fff389a4a82ac28e391b9d052e452597bb99a6da773bc178cb66ebb4bc6a63e4b09a66b6a2ed2cb0bbe5179320d75d18dfbe2a368c8de2f9425ec88ffd7a5864b32567c9787f52d0d3dfbbb164f4ba1ea2b43e4e4d6df9a63b4ab2f25970dfc5a509cdfcfd70c8efcf3438bc9db2708384c11e9bf9b024b0a4a24c0d83c847ec7ccf3c6ec640cb8aefeb48e5a4d020aa98666da27b7a4e254ef0712bba837e225c3bab8832957e1b157b55e7a7aad61d5e70c6a622bd6b87ae3ef1b1af8ba8f87b677c071efd88ffa5eefb14c44300e3da919beb4d9519ecdccc283d0675e0368167b505b525036a68a919835cf711139ef2b5fd98cdc1faa6fde2cd7d260c1743e8ba9c337c1e61dc54d93737f4189bbff01c0504e81981482e58c9d300ec0cf3467e84b5e41bddb01bd2b94aa8b36e116310ae9eb75d523120235e00c658de7db6fdf5fcc7f4701ac735cec960c6e9e62be66bee20a5b91de77d36f3e31596431b0cbb161d0ebea392ff99cbc0d6009942689910b2fc0d9e16481332c30e800ab4e6351329b451fb9bf604705a52e4ccdec17818165dbda9e9a57c021fb2b828b15ff014c5eaa909b884cecad4f38e487a1da0d28562821e012655ef7413861ea968cde43720864e74dac3ec607398561e29ac189ad557377b2bced871b3197cedba36b31004cabe2f03bf64e1c0b525adabd07521f3ff3254f75639b10d17285ab78676bba5e8bd8a9b83a6cb2ce7deb00d705af7dfba4605fd4518f1cd5097aed86a391874438feb8182e8c3f27483e763f163ac3e4f78aaa31b4674b8483216b514dc6541bb2c02bf8a24320b6d1a396a4b3cc1c32fe7e09095458603c5dd6fd08e95b1afded5bbecab7b197bd130eaf684f7d796d9258e47bb032fa4879bfff80a863c62b7f2b5aa68eb8fdced3e35ea72c2f523f6afc42bf47ec8bf060934a739f86be7309d649b0971bc3d556d66ffac5d0d6c25f3bbaade3ea999999816771b119a7432b757bec3085ff898483d45627e08e7c4289a825e8c334df067928cf0ede324c4428060cf9ff81c4b80ea8f35b1023653ba2f5bbd43e2031cf1d035dd65f33d087b873c9e0010cf6b87ef00da43e2435327af3c4a0e4ec3a74f5bb72b6de2f785a84219c18919d5a8e1339a250053055010b82888f8c8fa73dc39ec18166716a7f9912e00125788573be8134ee29d60e8b90ed03cb130494e56d4d59dc75a22a083c018c8895e22c3b6f974d476af32f70d2d85bfac68256f18af6eac6912b546f5f8489164b79db5eaabae96c1e48e94d81614ab2f436e59a43c2ae739b7663ebee493f55545b2a531ef9f96599d2405181a9b8eed875380717a2215c96ccc0fb8f355759e15a933dc00af87ce0ea71249ff6af08616e0024c2e72588c3359e3601f9ef2b9df1719ce280ba4064aa0cdaee7fd63ef52b144fcdfdaa3fb9bab3f0b3ffd259137714c970f710863c8765b0aa1dc2b131497ee15f0bce411636891c8027328ab81e619c57807d0c543392f01d411f2333d3252969b694e36041dc37f13778c6ab97e1f20870961390a6748fbf1e868b21f6eb0b1f36e8a0987861e7355927607dd1828fe63452f95a71469a5810630b957aeb9728e64aeedeaf2c2e28fb06d839edda9567ba0d258a7612ef199138e051dffd0cca0bf8bfc039fba9697a138dd3bb188920e8766a9fde64d1e4f7ad87b580b8f14017e3547087cf9c004c617a86958846a67ff19ed5f45f29effae59a4439c4432d50a35c330c69ac7f468567f63041e3736a0354eaf2a09a88c131dbb78e5214e76620310ed7b3e324af06e1f2da71fabfc8b38b167c19efbb51e3cce2bd009620f2a83a2d8fb2db2c964e58a0bacdf2b5a523aedf928912c4b60ff5cf8714dac5268f5b3e9077caf61a3b1eb4f88b23c26d11a506c58d8f3dad0ba6f6dd570f056646f557613e2cf3790e978818bf69fb1cdb16d4ddaaecdb09fa1c4cb846783b68eb2128d2dbdacbf43904a8eff90ec0db46402f23b037a0a18a8367d11b9e24393b7396e4f5bc01f9a25e58d743ab8e0eea1295dec59c966d452682789075d68ab4fc1cc9e6a0e361703369e1cc28989d6f4e47a008a2745c4727fcdd87033d914682ba3a63aeae690131042f987efe16ccc1a52c49eb0db9f989aeebca85a621edaecb4ede8ed3b8169636d1d1611ed0cbca134f29358cdd8def573ae1999ce1255a47e777991512bbc51785ead091296f8914aea442d1db9ebfc6a0df80d9eb3df6d47dd89b0cb3e1adf74124076b7f76f3f54b7b663adc593039c94859217c9ccb6fcac6318f10061f2e0b96d7f625ec838cbd11e84ac63a3fd0f70a0e65c96df15d6dea3b040d94b23aae54ae08b8654f54cbc2e91beb176cd7ce0952c565bea6920b6bb16f2978261b59d3240eca5ccc1a0b74a4ca8884c45533e262d266bf829b07b60ae5cdcdc2f814f886aa29841f6d63544eb1467d05be5588e50ed38c3dfd73ce31ad7b347115c762febd4ab6c108dd197d4fe7496301012c527af6d69cfba0d5b3651147dd34b764fb6e2c8c7d7d3020c376813fdc16efc32188f2353c51d2eb3981ee480474ef7198199e7ffb4ea70157940aad0ffeebd918214485a2958e5b2399673394e0089452faed3028e97508515c4e9f992c49661b6d9bb075dbb92ea00541be4c0abbc3f821d4f7b34779aa719362dce8dc2ea1c7caae501a033f984e7e992edaea9ef9bfb399784d83e670bee1140354495f8929d49803a3dfdc86c90356f9cc5562f1dbbfe71ac57c1f9aa96e7ad06f037258e89a55bfa43d5828782dc9100ced14aded7fbd8d845045e49104efda1a8b4e9d23ff955aace2494e2032ea5b15f5b75449b05523ab61adab7ed3380eac5231558727f8be5db60e891b76e235924a44acba6165196c6bc13d6c10aa47da45d52d3b762318a93753e10434e6b4a9bde3085bcee8308cec5a855f95c91644e1fbe2bf3950213a35b255bfb0a53bb13f976ad72eee062adeef6958ed82e0e270ba9e4a74d88c0b77c803ec0962d4c66b0dba84fc2955c3b504eebb7d93210576fc5560d9473f4faabf12cf845f37f47eb6ff42e13a3774c8b7826a1a0d48e58bca2fc39ae1805ccb5c718d72c2b1faa57d56f4994b8c08ff5b42b1955c9733959dcc13485ca27a80325119b96499fe6aaa5a4f0e76d93c615f30634e57f8f103e71303a6edaeeae24a70e8ae99a214b8dffc95dc64d4af68b5326a0b5a5732e40f0a29bf6efbb5b6dd5f1aa85b6e29f62555545174b4d8593aa343a3fba69ad63cb78f1110e7a46411dc2339ee7d3fef3e6bd754fa42860c9b92925aa1fc72ff36c8173f4b263e00ba8c22daca4a2c0c44faa009e0213a174f2f95970a084cb25be9d5ce057b01cba492ce7a25502599d5a60c670145f93b988b8a7d494efba63e2f33772165a7a6903e70a9c5a795e4f8846eff59428de6bc16a6da316f36e047cf208766ecccf313db1bc15da238fe102d1aa0db0a79c1d3bddddc025bde441b88b48059c157b22dfb57f343a8a1ff5995edf8401ff9f43ab3f48c965d662d1c6224fd6e90dc7bf99daf0c6d32e39ffda6c6ad1f3b22d152f961fcb1fdeb6441f9d13de018b48bef7e35c10526ac95e5daca00ca3467d54176cd8578ba61ac5f1defaa0128f22081a2d11cc3f893af741a274cae9547fa58b2d10303f8f88e7c525b7cafa734cf5abbd58cb5c7e22a5380886c62f687dbac296f5ad976ac5d61dc2298c84dd738a06a9677dcac52916f064b4ae761d6d30910b378c1ff960ac7112c2f7fba7d5d1cacb07121f30cdebe99ee2bb7ae51f22bffc449b00a8991d7b7bdcf109378303c6bd74c15e29ece4b1eee0e8d81bbac6c7cc8aeb23012f38c5a91e32cd67231d5cfc740a0c8c6dbfe9084edd62d866ca0e978eb24592f9e44ba7f35279fbab906fa4843b48acc1d2c5f535f24e369840e63b7bc4542bebdbfc141b83d6bf68f52e06c24aeaca368cb36932cb9e9080fdea113825838cc4a61f92326b344b4aa365b20221f77250bf6ae1c66834d8a4160f4f13905b50c8ac287c114eb9977826b31517aa528b1c88b123eb0515f1fe9f1b4b73fd3e8bbf1347d3fe76818ad653ac6d1bac9036cd1b2c62da75d909711ebf40e922e67828f48fe275c329bd5f8af2c4a91e601eed466ae76267205c708efbf07626da4f233a6d5c93941e5bf0c8e5eca9e83dc16de9c87b1ade04aaac75fd1f2d1445294fab810ece3899f5d504f3af6fe0ed7d9f8a988c1a32926120acd503d008fac7ef50b3207a6537dc4269b11834e92ca4e1822b3b9c877a57676cfadd479b2fb6b13dc4cd6ba4bf1e67d6f1a35155e8e40cedaca621cb2b73dda3d20bc7e808cf0bee18fc6fcee11ab360b26a4673afa2825e04ff16346ad48ef6e2ae7b67f75a4317e2b9b8b075fc983df0ff16e6bf944fa219934e0501e6ada8bdd3e0378908cf3c25c401ed905eb0f683775cc56808e91cc0e7e0a2bdffdeedbf84c5a752aafbbefa2603ec04fc118c4bd00d28ac216f6a9703ad5f17a862eab703f5e9ade806b26b22b15dda6c511c4c53bbd3a5fcf45c42f423c2fd9c15b35fdb9a405303978babf1079ebc7734b31f649df8da6f3f400f36bc45550625670f2a3b8fd94d2a109c5b8415da6732eb78dc16f038c8b3d9ef95dcf54a57fe0166f5b33491c5c25cfd072ca5bffd5b2d296e9fa6c41c9a632ca5b644bf79e42fa27c8e7557181cd296cbd9ef324e91399f4716d475768ff4f766d9d1a647e4c1f8401c8c05a887cd05f8528f301564fe9a67eac414b82c080c18ab07e60d3c7e796cc46b11aa704bb7341625c569dbdbaf7f1ecb01bf9483a657909f7e115b9a08bc9cdf522cae09aef35215ed07a244a0c2a6bc19a36a66a0c08e38c5a81221db5f60687874ce98e6a85166f68fcf1600cfad4774ca71b7d65727c74ed90c6c68bf51f95f640f3c30416aa54cd3f0c2207a872b77201ec3ed8567e1a82d95f3f4088783700363ce2285f9e503b590182bb9499baec69494f8ffc2a4714bf62ddbef03f03f5c022136822afb503b1fe4ee0fdef1f6ffaf8ad718e531506c73584d5683e5cf13c71c72fbdd4f39957ed8df125c7cf2f6a2b55eb0fe6c5053fb673d704f109b64c6421571cc11ade8b196da2c2a4931e62ab208a180cce797815fdce202197bc6f6f1d678bc6a254ee42d21cac1ac4f1e971df2d9004199a20cade77668269b0daeac7f152572ba31720e054e2f4c82d48ab308c527bdea7bfd84f21c2a9d165dba4d1f587104345ee60320f14520fdc817e72b34ae524ca4388ce9e10637504407967cd744b826ffd08fe3c485b9014981d02411e328a42ac1b046e522d9d673de18eaf1726bddbab9e1c3013133a5e06dfad2cfe4108e66a0481b20a2f684b47900b7a95d9d11c267428197c3a9ed34b845155944289766ee7fbf885032f58d8a5a7cdfb7a2a9851f93bdea4e5e540f53d7522f4033565ffc8d021aa135ca1c073f10e2c5d8d3823f7344536088d84f3eb6d8f2671769ace9178c8d60bc0ff34328b935473fca43c5aace7b89c635152a22968cbc7be40a7e86aab03f19c56bf02ee8cbc833902adcacf4fd4add9d2a01a51359e6ccba9ef36a4e22da34f50aa290ab5a5558d24f7a98ecdde03f564365c765ca5f571270dd5f6fe55c57ca6d13ce1c425973bb2780e70b08ac07f6e4c8adee", 0x1000}, {&(0x7f0000001500)="c2ca819ad84c80a4d8e5b0522fc37627d12f476f6172eca23b7c41d97fd979293814f0db95402469aaa8737853a32336dba05d7ca017c86816c0f56c4f57de71ab771d2ecf02d291220efd70e98680fe90fb88280ff946b4c852135178e0e4c05fd03f78149c456ebe61b7de765c4c1444e8e77727464c", 0x77}, {&(0x7f0000001580)="fc5eb1ff3ed3863624cab01b634744a0e5db70743803edb7528990d8276b7f57bbbe7e1b419f6798ac3e9b1201526059dafd329c1d74dcf61062e25d98062d321067204fdfe73718868c91191c440d", 0x4f}, {&(0x7f0000001600)="646c1717e06b94b46c35cd96796b0c1b20bcab322b273cef54af567beef75b064c343c3f213585a6f69eff293191ab76628b06a81d84f215c8d5675d742f4714a491", 0x42}, {&(0x7f0000001680)="148031f43c8f9f277bcc26ac70635bf5eb33114c2dcb627d9d8ab998378ef8d74a7d5d96faf3fc8786446772bf5ba48751768280d8e966821effb85bc78ce9279c9697ab47ad1293888b926c8fcd94fa6aa8a2bbbc386ff41b208a3c312c3c69534f9d1989203c15cd78139fceb2b046415ca2aa892f9248e8423a04765f68a99c7197f98b0d32b226f131d49e2086cd7c2b851e41085061789d74e54518fbfaf841101dccd159fc50b0b4682ed485cb5ea732560df0e5783a3cf84f18a63131a5c00b", 0xc3}], 0x7, &(0x7f0000001800), 0x0, 0x40000c4}, {&(0x7f0000001840)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002040)=[{&(0x7f00000018c0)="4875e0796bf27fb4ff7dd104b52d71306fcbc9fc9c198f247d48af694a5717679073d17050151cf174ca64a851cc72164aa5a1a9e03bd0e7a6dec102b0c1304e010eb64a430660c7c6b83f5ddce0fcfefef3c337a290ce735a63e1e4de0f", 0x5e}, {&(0x7f0000001940)="8e78e7e1c432aa00bff56f2e26f69c23757af69f5f61194520f99337607142bebf900b213bd8e92b1eab5b97579dcb15b006b5938b648ef51f61617f782187172255d47c1dfd00262a475bb0ff033070c6b6471b47e8b5275b10044349ff2f4587a706cb0d270d465002971540ef8836bef9dfba57114f96e06e9e6b0f116c47a431d1e0a290", 0x86}, {&(0x7f0000001a00)="3437312e8a38560017e504b8dce4d64ce1631db21db2c2a6f45248f7354a5dd176ab2cdb4ef0387e7a8915481117311bc700d0315d902aa4cd8c3fa5f2ad7c7282154edd9b5abe38b6705b0989d7a1ae0b910f728e9331de2e61850d3e95a705b53d572d0ecbe2edf9333ade87335a0f1d42a736b9e22d313a3e15f9bc49866c72849473905471608c36956bd3dafa80681d699e763b9b2e6b388f77d0539da8e44875605e0ce2a61ab47b3f338806b58d9b48e550f0d55a0e885133f0225f82f1a7e8a6e6ebe0e3bca9a74aff9e", 0xce}, {&(0x7f0000001b00)="8dac655b685bcbbc59ed53deb2f330633aef9890d6b58efcda8111af6dc9e346b5451eb79f7c21b573274c2f58719b70d2f53b177faee01ef8ea732e834c1949607c2074698eafb569c1817550d570e37e938a0fe4f250e22cc1cf747d548b6522d723c95033365179748256582ee30274c45180e6c6befe2a98eae7d849ba6d57fa508ad5ea726469e8151b15259da184790edc59c4144b2437df7de17f342ac610358ca70e2a2a63daaca5d007e7598def465c632a129cfd043ab2134c6d03b422eddecaa7bb02d35ea7e581f0cc6f4acdc5bb6be851e5d30de26fb2a13b4487a64a25228f5be3b4", 0xe9}, {&(0x7f0000001c00)="bf45934fcd6dccf824c64deed44dd2bff4c3be96bae5d38bc6b6bb726f5ba38b6c7ca99f95defcdb8b51057e4037508cb23fcb38515dce26f80219744e8de6a34c8757f401f111dc75556b92d1bc29bad893e666bbd23475b43807c60274cc67902c83734491bc2d1f779afe756cb0dcc95e05fdcbf383d7d30e1337d889338cdc9b8b9adb67b9ed64b9d96af44a592fd968a8c4c471132f6092520e632ffb798d77f217efa48929dac32beb8a4a6ea1f1ffeb727e04a22b2b8f1b6a089e6d2f15c73e51abd5f3eb837de08ca4b47822bebd0122af5a5d21a4ed8ecfe0293caa2d5f8fbeef1903ff883888e072722f6830bc229fd8005940534f9cc77f47", 0xfe}, {&(0x7f0000001d00)="200559a6f082dfd358f0047c5416efaf86f2a0a36d0f1403b207", 0x1a}, {&(0x7f0000001d40)="291262cb7c3d4a2b083e79461b1a271bfea5f10f5f46772907b3489b52c6ed33ea79c6c75d06dc741d99d22e8505e4bf8e020925d6d48e0c819d39f72d652ac5a0590d5cabfaf3685862badb5c9f19ea83ac1c16662f026c00f0f617957a43575862c08f8fbc8e6938ba8b14ad889d10125a9ae2faa67ed1502185718de0da", 0x7f}, {&(0x7f0000001dc0)="1c9688874a041997b9ac2aae0f7271064da22afcd9913c786cc4fd936972e1544ccce3f1c76fcff1118fb10f1ee0fe96ca6de1ac6953a47382f9bd3bb7b431061836cf7aeda1049773abde076bab8cf979142483761afd16ea698dd473aaed495a884a7d565ac424510e36991763e7ecb726d6fba039846d01b76c7b671b2ee02fc3957f8ddaf9315c567167dc1a917c2d4d14dec8ab4ddf2b2c5710c3d62aef5d4cd6914f13e674d57803063a18d207f75c3679ff4221fcc3e3f7501560c8745f01c86b6a235b7a4e965ebe7a54fe13731901206a90ad4e2bed809117", 0xdd}, {&(0x7f0000001ec0)="462737889310ce984bfdcc82699af9848fa8ef72ce5bf4dfc606e18416c6fdeb9df8fde76a529a80c261fefbc6f873ac4b07d76f1c6eb1bfebcc2f6162b5d575e5d2b53357804cd6cd3499e4752d67e84e05299541f7c43bc275e862c02356b887c9574a7c37042e0c2c705d761422a87c6047103723b16575aaa20c705a790ebcf5f2a19b768e0a", 0x88}, {&(0x7f0000001f80)="134451005e3538b7fc7a4969c8d8c9c67d3ac5b5826c8659e63c9e3af1e45961ed3bea5bf4bfe35851815281af89548e7efa5ef5abfabab8d87a746e879b67e32ab49099a3489d1ec57d93b3efebe7ce15cc53a202981a61117d3cd2a533a3dc973ce85492b5de630f87ba0b0d916b8f514865b2fa7d11763e953e6a9599ebc771099bb833102d373696cf0a39d64b94981e4957cee3fd566f4d79abd0127898", 0xa0}], 0xa, &(0x7f0000002100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="18000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0], 0x38, 0x8081}, {&(0x7f0000002140)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f00000021c0)=[{&(0x7f0000004580)="4dc6c44c2f5eb884bf4b0e94b852d060fcf64e8996eb5e33681322ac52f0fb085450919efd3e51a300c513e9cf5b3b3d491f22d5511be3cb7f5c5f1fef7a2db20677659da6aec4e2b281049bee41b938baea58788c58a5b31937f33a92a6f1df6467531e29f29e8dfbd71a27cc6ef48647fcff6c85660a82a473cedd5bf18f6b9d85d171ff283b87eca3266943d4ed77133cf604afe4b68aee4f41380d1d755613345a4812a4048372e4a1f88f1594053eedc101b9257f4376ab5e8b1d5ee9b875c4171e82cc72e3236d7a0ec8e6e2f1aeabc4989e59622ad6db598ce94cbbccccd55c90857cebc2fbebf06f89", 0xed}, {&(0x7f0000004680)="54d96ab35a17a6b5f0d2871f5a84edfabd25350e2738a21204e67f598a7c2b31f2384b9347b6ca583c13683a81631447af2702d7d39f5de84ad161100a16a48a7bcbb64e8c64f6b1feee079d82053e0cfb28154e843806f159b1511193776fc703803b104913d415ac31b8aa99dce505f5fb2fd3ba38b0ae5e3be38e3eb6caaa20eb91d7b0953e1547095b1f2a5fef205afcf29e0cdde0df193f99656f79d17f990d3e9815c2008670bfa49fa0b3ad9cc640d9b931c96466231047367dd6480e5ab0742195336e98c367ca36234b10c41e59cd6bbc60afd179fd2f83d8ff8c", 0xdf}], 0x2, &(0x7f0000004dc0)=[@cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}, @cred={0x20, 0x1, 0x2, r23, r24, r25}, @cred={0x20, 0x1, 0x2, r26, r27, r28}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @cred={0x20, 0x1, 0x2, r29, r31, r32}, @cred={0x20, 0x1, 0x2, r33, r34, r35}], 0xd8}], 0x6, 0x8000) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:03 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:04 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 398.365116] binder: 21682:21689 unknown command 0 [ 398.371640] binder: BINDER_SET_CONTEXT_MGR already set [ 398.379078] binder: BINDER_SET_CONTEXT_MGR already set [ 398.393184] binder: 21680:21687 ioctl 40046207 0 returned -16 [ 398.396876] binder: 21681:21686 ioctl 40046207 0 returned -16 [ 398.406490] binder: 21682:21689 ioctl c0306201 2000efd0 returned -22 03:37:04 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 398.428295] binder: 21681:21686 unknown command 14152203 [ 398.429157] binder: 21680:21687 ERROR: BC_REGISTER_LOOPER called without request [ 398.451767] binder: 21681:21686 ioctl c0306201 204edfd0 returned -22 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x700, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 398.481148] binder: 21680:21687 unknown command 0 03:37:04 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:04 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:04 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 398.503134] binder: 21680:21687 ioctl c0306201 2000efd0 returned -22 [ 398.508654] binder: 21681:21686 transaction failed 29189/-22, size 0-0 line 2852 [ 398.533978] binder: 21702:21703 unknown command 0 03:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 398.567822] binder: 21702:21703 ioctl c0306201 2000efd0 returned -22 [ 398.642589] binder: BINDER_SET_CONTEXT_MGR already set [ 398.650787] binder: 21681:21686 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 398.658310] binder: 21681:21686 Release 1 refcount change on invalid ref 2 ret -22 [ 398.663064] binder: 21716:21717 ioctl 40046207 0 returned -16 [ 398.666083] binder: 21681:21686 BC_INCREFS_DONE u0000000000000000 no match [ 398.666094] binder: 21681:21686 ERROR: BC_REGISTER_LOOPER called without request [ 398.669170] binder: 21681:21686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 398.693936] binder: 21716:21717 ERROR: BC_REGISTER_LOOPER called without request [ 398.724433] binder: 21716:21717 unknown command 0 [ 398.729500] binder: 21716:21717 ioctl c0306201 2000efd0 returned -22 [ 399.157159] binder: undelivered TRANSACTION_ERROR: 29189 [ 399.167402] binder: 21681:21723 ioctl ae41 1 returned -22 [ 399.288547] binder: 21681:21726 unknown command 14152203 [ 399.294133] binder: 21681:21726 ioctl c0306201 204edfd0 returned -22 [ 399.321052] binder_alloc: 21681: binder_alloc_buf, no vma [ 399.326888] binder: 21681:21723 transaction failed 29189/-3, size 0-0 line 2967 [ 399.352166] binder: 21681:21726 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 399.359753] binder: 21681:21726 Release 1 refcount change on invalid ref 2 ret -22 [ 399.367545] binder: 21681:21726 BC_INCREFS_DONE u0000000000000000 no match [ 399.374646] binder: 21681:21726 ERROR: BC_REGISTER_LOOPER called without request [ 399.383685] binder: 21681:21726 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 399.391489] binder: undelivered TRANSACTION_ERROR: 29189 [ 399.397140] binder: 21681:21730 ioctl ae41 1 returned -22 03:37:05 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x101000, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000200)=0x830, 0x4) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) r2 = request_key(&(0x7f0000000480)='id_legacy\x00', &(0x7f00000004c0)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) add_key$user(&(0x7f0000000380)='user\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000440)="cd5363e8413893cfe9130499b428899e1805efbaab52f2b29a93feb96517d202847010523b85b0492904c2a3068cef7b5a6200fe475e2469", 0x38, r2) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000540)='mqueue\x00', 0x2, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3edc0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:05 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6800, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:05 executing program 4: setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000)=0x9e1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 399.790046] binder: BINDER_SET_CONTEXT_MGR already set [ 399.798216] binder: 21737:21740 ERROR: BC_REGISTER_LOOPER called without request [ 399.807444] binder: BINDER_SET_CONTEXT_MGR already set [ 399.808063] binder: 21739:21741 ioctl 40046207 0 returned -16 [ 399.820277] binder: release 21737:21740 transaction 328 out, still active [ 399.827347] binder: undelivered TRANSACTION_COMPLETE [ 399.833379] binder: send failed reply for transaction 328, target dead 03:37:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000040)=""/87, 0x57}, 0x0) 03:37:05 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:05 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:05 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 399.844876] binder: 21737:21740 ioctl c0306201 2000efd0 returned -14 [ 399.845075] binder: 21744:21749 ioctl 40046207 0 returned -16 [ 399.853896] binder: 21739:21741 unknown command 0 [ 399.866016] binder: 21739:21741 ioctl c0306201 2000efd0 returned -22 03:37:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4000000, 0x40) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000040)=0x3d) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x80000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:05 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmsg(r1, &(0x7f0000000000)={&(0x7f0000f7ffa8)=@alg, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000040)=""/87, 0x57}, 0x0) [ 399.940901] binder: 21744:21749 ERROR: BC_REGISTER_LOOPER called without request 03:37:05 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x0, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 399.993164] binder: 21744:21749 unknown command 0 [ 399.999132] binder: 21765:21766 ERROR: BC_REGISTER_LOOPER called without request [ 400.017421] binder: 21744:21749 ioctl c0306201 2000efd0 returned -22 [ 400.022562] binder: BINDER_SET_CONTEXT_MGR already set [ 400.045245] binder: release 21765:21766 transaction 330 out, still active [ 400.052342] binder: undelivered TRANSACTION_COMPLETE [ 400.058106] binder: send failed reply for transaction 330, target dead [ 400.058183] binder: 21768:21769 ioctl 40046207 0 returned -16 [ 400.092225] binder: 21768:21769 unknown command 0 [ 400.102448] binder: 21765:21766 ioctl c0306201 2000efd0 returned -14 [ 400.122174] binder: 21768:21769 ioctl c0306201 2000efd0 returned -22 03:37:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x74000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:06 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:06 executing program 6: 03:37:06 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:06 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) syz_mount_image$btrfs(&(0x7f0000000480)='btrfs\x00', &(0x7f00000004c0)='\x00', 0x20, 0x4, &(0x7f0000000700)=[{&(0x7f0000000500)="af2c533efe48c9bae94d2c3eeef921da4f3fb1f2c970ea66ce5a90336ea30f6ab4252234aa31ee1f1c13b2c5a98dd77e60fa0fc9a7252c34cf3a779ee2ca13d1b44b25408c28cb0ac007cd140c8bb9ed5c20df144827106b755ac70e90eaf6eb69dc463ebff8e3315ef84d92", 0x6c, 0x2}, {&(0x7f0000000580)="d752420263687d11b81b3783a5e9b04efde73a715fee9515230fe609f38fb2360119fe5ffe8fccc9174c1c5a47f34c714295e42ed038fc74a4b0416a1ffdd7b5a8a3f7edbc878bd13d341e28f0bb4c4998d7009dd4b9d2e404c8c71b0f831454d7cdd690749a0cbb097df8bdc54f8a614314018bd318646f1487eb599a3007b30db978d96f337ff6df1c311ebe6c2b2e694fa40f50c6b728d3d5886d65c4d9ed5f15ee75", 0xa4, 0x6}, {&(0x7f0000000640)="96b587038fc8c11a984e291704841999c73a44f53bd1cfc07fd7c384759cdc55c4a0a7f1dd118341fb6cd7d638905b338df6a447e5a6e7825cff102ded468b209f03c38741bf09214ddc", 0x4a, 0xfffffffffffffffa}, {&(0x7f00000006c0)="19880ef05897f291b1aa7dc55cb1b3aa8d62b9c678f713d7f24c8c6d3fb5bea826feff4bb14d44455fdbb52258db245abbe5b96a44b6", 0x36, 0x8}], 0x0, &(0x7f0000000780)={[{@subvol={'subvol', 0x3d, [0x30, 0x3d]}, 0x2c}, {@nodatacow='nodatacow', 0x2c}, {@subvol={'subvol', 0x3d, [0x65]}, 0x2c}, {@degraded='degraded', 0x2c}, {@datacow='datacow', 0x2c}, {@nodatasum='nodatasum', 0x2c}, {@compress_force='compress-force', 0x2c}, {@ssd_spread='ssd_spread', 0x2c}]}) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000800)='/dev/rfkill\x00', 0x505000, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2c, &(0x7f0000000840)=0x1000, 0x4) fstat(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000440)=0xc) lchown(&(0x7f0000000100)='./file0\x00', r2, r3) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) alarm(0x81) mount(&(0x7f0000000880)='./file0/file1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="3d7bd802431e51012ac74a1c1b47a409b24c84c68f68e06e1f8fc62cfae64fda23915f274f87d4f629e8848cadf30b988196d05f50cba0917b64aed44b40b3404d8921b86712b8c3dc97104f87244cd3fb9f40c2ef116a120b46e4ed5b2deb751a32c881c578e0da1ceff22ebc551dab9ed199"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x41) 03:37:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:06 executing program 6: [ 400.973635] binder: BINDER_SET_CONTEXT_MGR already set [ 400.984488] binder: 21785:21787 unknown command 0 [ 400.990834] binder: BINDER_SET_CONTEXT_MGR already set [ 401.013270] binder: 21785:21787 ioctl c0306201 2000efd0 returned -22 03:37:06 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:06 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 401.024388] binder: 21792:21794 ioctl 40046207 0 returned -16 [ 401.041523] binder: 21795:21797 ioctl 40046207 0 returned -16 03:37:06 executing program 6: 03:37:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 401.072919] binder: 21792:21794 ERROR: BC_REGISTER_LOOPER called without request [ 401.086539] binder: 21795:21797 unknown command 47741757 03:37:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x1000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 401.116202] binder: 21795:21797 ioctl c0306201 204edfd0 returned -22 [ 401.126643] binder: 21792:21794 unknown command 0 [ 401.151322] binder: 21795:21797 transaction failed 29189/-22, size 0-0 line 2852 03:37:06 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:06 executing program 6: [ 401.163299] binder: 21792:21794 ioctl c0306201 2000efd0 returned -22 [ 401.184546] binder: 21815:21817 unknown command 0 [ 401.203492] binder: 21815:21817 ioctl c0306201 2000efd0 returned -22 [ 401.216655] binder: undelivered TRANSACTION_ERROR: 29189 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:07 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:07 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x120e, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:07 executing program 6: 03:37:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = dup3(r1, r0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f0000000200)={0x6, {{0xa, 0x4e23, 0xfffffffffffffb1d, @local={0xfe, 0x80, [], 0xaa}, 0x7}}}, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:07 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x50000, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x7ff, 0x10, 0x1, 0xffffffffffffffff}) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000380)={0x2, 0x1, 0x1, r2}) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:07 executing program 6: [ 402.158845] binder: 21835:21838 unknown command 0 [ 402.165665] binder: BINDER_SET_CONTEXT_MGR already set [ 402.171641] binder: BINDER_SET_CONTEXT_MGR already set [ 402.176400] binder: 21835:21838 ioctl c0306201 2000efd0 returned -22 [ 402.194439] binder: 21839:21841 ioctl 40046207 0 returned -16 03:37:07 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) [ 402.210568] binder: 21840:21842 ioctl 40046207 0 returned -16 [ 402.223384] binder: 21839:21841 ERROR: BC_REGISTER_LOOPER called without request 03:37:07 executing program 6: 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x600000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 402.259454] binder: 21840:21842 ERROR: BC_REGISTER_LOOPER called without request [ 402.277254] binder: 21839:21841 transaction failed 29189/-22, size 0-0 line 2852 03:37:07 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 402.311186] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.327691] binder: 21840:21842 unknown command 0 [ 402.328597] binder: 21862:21863 unknown command 0 03:37:07 executing program 6: 03:37:07 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) [ 402.358812] binder: 21840:21842 ioctl c0306201 2000efd0 returned -22 [ 402.376122] binder: 21862:21863 ioctl c0306201 2000efd0 returned -22 [ 405.856442] binder: 21886:21891 ERROR: BC_REGISTER_LOOPER called without request [ 405.904764] binder: 21886:21891 unknown command 1077961489 [ 405.942961] binder: 21886:21891 ioctl c0306201 20007000 returned -22 [ 406.091758] binder: BINDER_SET_CONTEXT_MGR already set [ 406.109909] binder: 21885:21894 ioctl 40046207 0 returned -16 [ 406.152129] binder: 21885:21894 unknown command 0 [ 406.178704] binder: 21885:21894 ioctl c0306201 2000efd0 returned -22 [ 406.367075] binder: BINDER_SET_CONTEXT_MGR already set [ 406.376064] binder: 21887:21902 ioctl 40046207 0 returned -16 [ 406.397963] binder: 21887:21902 ERROR: BC_REGISTER_LOOPER called without request [ 406.408761] binder: 21887:21902 unknown command 0 [ 406.413718] binder: 21887:21902 ioctl c0306201 2000efd0 returned -22 [ 406.427812] binder: BINDER_SET_CONTEXT_MGR already set [ 406.448106] binder: 21914:21915 ioctl 40046207 0 returned -16 03:37:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x700, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:11 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:11 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0105303, &(0x7f00000000c0)) 03:37:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:11 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={r0}) sendmsg$nl_crypto(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=@delrng={0x10, 0x14, 0xf01, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x1}, 0x4000004) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) listxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200), 0x0) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000040)=""/19) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) remap_file_pages(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x8, 0x82b1, 0x1) 03:37:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000), 0x0, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:11 executing program 6: 03:37:11 executing program 6: 03:37:11 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:11 executing program 6: 03:37:11 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) 03:37:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000), 0x0, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:11 executing program 6: 03:37:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x74000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:11 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) [ 406.482734] binder: 21914:21915 unknown command 0 [ 406.497715] binder: 21914:21915 ioctl c0306201 2000efd0 returned -22 [ 406.637800] mmap: syz-executor5 (21924) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x60, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000), 0x0, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:13 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7400, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:13 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(0xffffffffffffffff, 0xc0105303, &(0x7f00000000c0)) 03:37:13 executing program 6: 03:37:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:13 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 408.078248] binder: 21929:21933 ERROR: BC_REGISTER_LOOPER called without request [ 408.121673] binder: BINDER_SET_CONTEXT_MGR already set [ 408.127738] binder: BINDER_SET_CONTEXT_MGR already set [ 408.165192] binder: 21937:21939 ioctl 40046207 0 returned -16 [ 408.170901] binder: 21936:21938 ioctl 40046207 0 returned -16 [ 408.199844] binder_alloc: 21929: binder_alloc_buf, no vma [ 408.205518] binder: 21929:21933 transaction failed 29189/-3, size 0-0 line 2967 [ 408.222493] binder: 21936:21938 unknown command 0 [ 408.227549] binder: 21936:21938 ioctl c0306201 2000efd0 returned -22 [ 408.278826] binder: undelivered TRANSACTION_ERROR: 29189 03:37:13 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0x0) dup3(r3, r1, 0x0) 03:37:13 executing program 6: 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x60000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:13 executing program 3: [ 408.325686] binder: 21937:21939 ERROR: BC_REGISTER_LOOPER called without request [ 408.404753] binder: 21937:21939 unknown command 0 03:37:14 executing program 6: [ 408.438280] binder: 21937:21939 ioctl c0306201 2000efd0 returned -22 [ 408.465200] binder: BINDER_SET_CONTEXT_MGR already set [ 408.482123] binder: 21948:21953 ioctl 40046207 0 returned -16 03:37:14 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000fa8fe4)={0xa, 0x4e23}, 0x1c) connect$inet6(r0, &(0x7f000098cfe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) 03:37:14 executing program 6: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) 03:37:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0xc0ed030000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 408.501889] binder: 21948:21953 ioctl c0306201 2000efd0 returned -11 [ 408.593515] binder: BINDER_SET_CONTEXT_MGR already set [ 408.626825] binder: 21962:21964 ioctl 40046207 0 returned -16 [ 408.637758] binder: 21962:21964 ioctl c0306201 2000efd0 returned -11 03:37:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x48, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:15 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0x0) dup3(r3, r1, 0x0) 03:37:15 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x700000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:15 executing program 6: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x6e) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000001c0)) getuid() lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)) fcntl$getown(r0, 0x9) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@mcast2, @in=@dev}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@remote}}, &(0x7f0000000300)=0xe8) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0xffffffffffffff9c, 0x0, 0x0, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) stat(&(0x7f0000000340)='./file0\x00', &(0x7f00000004c0)) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000200), 0x8) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00003b9fdc)) r3 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x15, 0x200102) perf_event_open(&(0x7f0000002900)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000ed4000)=0x7b, 0x4) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4000000000000, 0x7}) ioctl$TIOCCONS(r3, 0x541d) syz_open_pts(r2, 0x0) write(r2, &(0x7f0000c34fff), 0xffffff0b) ioctl$KDSETLED(r2, 0x4b32, 0x4) listen$netrom(r1, 0x5) 03:37:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000ff1000/0xc000)=nil, 0xc000, 0x2, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000040)=0x0) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f00000000c0)=r3) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) 03:37:15 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$msdos(&(0x7f0000000480)='msdos\x00', &(0x7f00000004c0)='./file0/file0\x00', 0x2, 0x2, &(0x7f0000000600)=[{&(0x7f0000000500)="4ed35b474be2e78c641a30a1c46ddc880c4a20bb4f47496ca8759d653cc00e03d30c18e70447636dcce6fce873ead437163d0b11da60ac22186b8e2d02de5931f44dd97d3f57e149100cea739bea00e36ca7db236a2c51e7978cb9ea76e7f2fbf0689e4c99753b582d9287a469823e73f3464d2f673ca58bc6a0784d9499de7c53b6a68abb0c38d055cbfc86c78679ea0636990324366cf3752580b1173a6c4f39961e94a4054d9cc2d7e4265fe10f3e02f225bc742ed3d5b9cc6cc7a7e546cd2d54ab169baa01be64fdc180ff58e24f210b", 0xd2, 0x5}, {&(0x7f0000000900)="da1ab0593d26b3a745f662b005a1e635515a10c69d5c9824d3002bdea3c3424d3b8e220cb33c3feb1f2685163a8b5f350349373ca115ed46ed21802b4ff537119f2aa3912ae2299db15598f6442eb292bf3a27570f1a13699e1eec33543ce23ceb495f3af5f9d9d270803b99b026e187e0b1b5f18276173e17bf739377ba7066c32acdc88762ddb2b6fdde1ee8bd3aff4ab7d33e27abfa7f3c14e770132bec5db36e1494671d5881112d4a744b2d2183234f5c7100de0bcf55c0c7102678fba5b704dfa5c7a2d0d3ea32a747da1751c193d78d764a7b39433cdbb1cf734b7f35960487a0ecdcc27e98e5cdf4214a36cc270761baf4d6f3b614dd5a94f690db73fe060bdcb53359b7a6c3971226462af88f5ba9322d5eb7114759ed3ba8648142b31ae3e8b8c37d13e2a8b00bd55eb11f568656f6ca742ced9bece223b69e57426b014b906198f46b219868c80912a90b3270b77b7c1642fa606671fd323c21a4c76a660a196e07203d11d9ffcdb8549a46878543a32fea1873b839ffde784639ea0bafc32ec44965117206be755e47d481f3cb923563eaeafdd7b92e66322ae374e71d0ffe36afce8c55fbebb77798b944b057877e3c546fbf1d3e24d4f85039efb17d5f4f5a10ff1d2e3e066707c10cb2a1787a8fc8863c7ac65611732cfee94e4dc2045e3c7629acdb284b44afa3acc71ea9f0232b4fb6c5e5153431c6d5fc6da054f554d253466dbb6815a02f60303efa8cd3632f1d60ee3fc7bc499239a01e0f0cc06c9aaef1a766ee9141f6004319974143cac7017f060864243aa8346bebc34dfddc11415a4247027eceb75dbc3f2c824be943e816764f9ac9f64e2d8326e3c9f4a230bd88f0c316779f187172ffd7310466b293db2069f07dc30f06902969943880e31a093ff9ce738a3dae4982224751d81b0a3686929e56b4ad6fe6ff2484f6745f009c3f95cefd5c18c5e91d9c3f2d2a11a04ded7888502899b38403a4ea4c81580ec5effbb6ef4ab68030eaa4a3ffd5669828be91c1b5c1d86e85378069ffdc6d7b3d3a59e43fcfae2b49a1228be9af59bcb33e934b3c76310d571bdbb2110e7cad61e3105a6162524af84cc91155d45fa2a90734cc8e8e9cd518351ea05475330208939587a2d39a54cd77ab86573ca5deeacd593561ddc02b9648a0382e1f8c469a65d3fd866e70755b724d7d41d4cfc856379cdbf90ea92b5cc24a09387e43fb8eda0e62c10f2047bddfcf15f6525a4104e2ddfebfdb205a258de2c0e9c7e4c67684d074c5db752e5d167f605eacacd0b6f5221d8512e280194bceb2a8eacd872cceee5ba7695eb8a256b6a0010cb7596002b19300397dbd8c5484a6599b3231dd5fc67856097d33fa0b89e78d7c6b71827d29fa946790ef6a3b9a67d1c41eccaa9ac550371308adef7903129e63c7577814f3874b71f9919f31be3189205e274808397f02b30feb52077262314e63eb6c7e22342e5ab28c39aac92861afe55ebfd7453b349650a987b9ad98301dfb707dcee9a7faced183a31a39b0e493b3cf8ac5f5a47911806df2b4f2915b596f420b7f7b082e4d446de2fbc743d11428163512a0b27c286fd969574f1d6c679ca3eacea2cbab5349c165cdeb908191014ce86bd06f3fb6dc6473bcce268ab0c963cc7ee9f4af6e10e01a20647c3c70ee0613fdf8a0eb3d709ebf46ce199becd2e4fe7c69b851f696e2de8520aa4231ca40492319283218abf0bd6385880d0b2e0d51464f433c660f0d5c639fc168719775b07c4c9d84d215da728c82ec40edcf55523c381c05e483efad14fdfa86fd6363970ee3f0e36436e3af3c70eb5c9bc0ac14c1918aa89c6693eef6f2bee48a5d28db6834117fe5dae376de4dc9fec7470d1d5199fbfc0c04d5e00723ad759d9838abd6b32976a9fa1a25c5a6235f3d50660d1e11311bab1ed888ce67039fd707d0261bd9dc6b80973db9ac0d1d1731b6d11e69de2e4019fe870e87f7a392a06aa4367f55449e46a81738115342cc276fec1941a0324c00e172ad14f5fc4517f663c9a07b6f6320e46b53689da5510c38453eafd9f1af9568cd610a500697dee861bf0cde2ac8723d54c1ae9a16fd9c73cf222722d9045373d17ea0246e4ff2d1a49122ba151fb1956c24dcc3fe6e14414d6bd39ad2b067522f25403f2bd70e74fb234197e085639d254663b4ff073e57c46648a1e42a6121c33733e2c9868ecc9d0bda39e79326d0609f77de803b50fbe0a60562c97910d4441e11451e8d1d93f1a7e3a1d10f05baf34ee41ac2103df5114d9f5dfe9a6f3b9a4be3f62f44be65996f479e14e52a9670e0fa30995103c3744f485008361e0cd1e783d56eccfc8f76a964a512c490c38541bc2027c18e11e772202650136fc94b3272c138d67ff7fab20fe61a43cd6dd4279fa55156b45a02e244a8a9bda88dc6671bab6fba79236e57df61561a1e6fd124b127bc6e3381d32f61d7897e1133a321ac3e1ca8ffe95b3af396628fe0b8e78e4dc6af1f18559d227b166a842f92af8c8858006f5d1b554b6373850f21061175f359da18a9f272778df9e9d71c457baa660ef731d17ea0e77f71d4fdd651de27bdbbf0d5b49b1ee45a1e754ea2332dc43e3946f1d2c5ac5cf3a2e79b8fea46d1a0fe860c5d72e62ee0ffa6b592f567074cdea0bf73a08c1f30904162d153ead6bcce53ca046a795a00d147b14cbd8467d2b91523ae2b9fdc845acfee110183af344cd3361409adc7425fa11ec966a48d646996c559c7bdbe26499df90d8aee10d896217627e60418c34001c562a6f5a28fa245285d85801ebc20142a54e547737539c2a0704a41d7350da27018a67d591b54ba5dd8d8b85284a576cf26296bb575ef0b4417eb029dda26e362705265fb83490bc6167c1f3e9dea7a8a689be6172a2eaa0ca7a25a042555231b77ee671bc5faf1b9010bb27f56b7c15b15700729457d0c94a4a0a1c80a58752870a7d07e4b2c0be2a6592d409e703d27e30f5709883da85a3320307ff6c5534eedbe108710ccd59480589627c6c1840a53b73bcbbc4ce5df173707d4c114bba284948b1db88655e197a2755493e8646d81ad5cfc4552f4651e8fd2a43e4dd4dfc2561f95f553daf0ca06b19169146ea7d9bdb588a7267ad3ba6a145c1c24e30d34a7d6d20707dae0dbc0554cb7d7262b5bd386efd328f448ecd1d5c96fc557323726cdca48e405bf30e7f3a57c47d233339ee73a7a4316486fc04bd879d4b9e599715bde77adc58b3b119d1183f469b1d0447a05a1d4a0c021185e63e647a722172f0302c39ae8243015f939667b70428a491218438268243bd43a1357df35d38eb992b36862250b7d00db945f6ce755e157361d45fa4b2338447ba95709f56cba929ce06288ac0576886c94f37cd47454ff3404e0ebe47f87f3d02321af98a050ce62a2dab37db65db71f8646961192f463bb48d9a95b0a7db686d072093607a1af719b368b43c72bcaebc54725e863ca0927c0937b603762b13592900fca019c40c5026648e6ed74468a45ed5d87b5601f7d93a05ad2de4a551a561dfe8872e9df3a58a9e84ba3748bae59233eb36933bbd502171b1a1ac9deae36051e669c99d72b4ba410086f0f2c7e712116cdc670888233749923ec71402a605285bacb57c5e609a7e6fdfe46a1371b84fb72fc085fa2783b853b586e71ed2f4709eb88e808a32e6dfde041fdf326beb9cdaf5bfcfa6e07a274a63df67f9db5ba43cf57a84753b96751c0619f57831993d2935d08a0aac70e0d9554a8d08d91e916984c62bc1bf9fed1a5e58a397226dae20bad1157f8a81fe6472157fe802adebbbe823ac4e10674e48b0263abf72541af301916f9b8fad9dfe676e85c4ae28b9a74d622da91388c6910e090f8d9fb5315191db9d80c814e4b27fd257b1b4c5aa8000b49eb3d3619f53c6a80c0a9ae3f816b0a1f46dc7fab9e4e6a32462feca6f71e76bf5251cb56f10ce5217a6f174b74c63f594e5fd3711ee4c2da24899b960523026d475a8a3b4e79ffacc78ce13878b1159eddb5b9329c2fe9d01b6ba6e1dc2daa22d629eb5c40456c3f62176a761a3c1f27cf421d7184464f0248cba09372b349cd57d8e6b468ffe14f939121aa24f49f9c234cf58d0711e27afebb6a613bf5ab8d0ba26d61f631c569a109f30c5a58229575d55e7c66f6e0b9c44dc9060fb59966a30a600a45f1c4223293df96c510a0da70e22701c008c447df544f2e361cebacb3d91b8385e45cff54f03d5f600fc9d556de712371e898d4601cfaabecb66aeb1b7ae634cc0185b5450161e26c3af56e053316df75ffb92006911cb776880dba91e2130aef6579351e0c76128f5be880e613e447b6296f96560c0027157562801e51c51b570b5809656976f81dba8421ebdafbe50e2cc454c71ea9e0c1eb9af5d8365ea27e3fa3757e748fe594456065f8d84107775b0e4aee991c89ddb6d5f7531ae62e7af3567c80baedb7613923d1508b4d7fd855712279f4e4a765f04b64822cf4dc8b065883b21a3f65d438fd0a3084ddf39c4fa03757d051fcf8e2402a39a3435c5ca8f3d4e0830797b56bb294d5aaadd4b182e844c0e84e22661db9e72e294978c222a81bcbf9e821c194258b577ae72819d98d2c8ce5da53f7ac7185f150dd43c85673d14687f6dcb69ac8c1e4c49acc7cee5983356fe01da1ee74b9500ca8fb6b786364182bd2cce8909f06738bbbf2f0664dd67f01981186657dc3111f9f4e5796b9686f52601641322e3b8d9fa010435531d425b1c31ff929046f5f21f3f12178ad85fe755d2b4ccc0be1d158e2fdf0e971eaa56a1b87030b05b3b6c42e32135c7c88ba06e4914f1d0f2456268c04123dce7b061c50f2db63a76b2cdac69bf9d70238ae5b2d5d587a8f291a3c5f900b75d673ef58fb1c927e5bd3341ce01e38088f034ec2476b39180a106c5614c7a3acaa3ca081167a4afe39096dbb5f16d493d17cd6e193721705b9dc3323b7508aa49ca7d7355a23166c22302ec5dbdd59de432f3680f235ac1a42e65b50cc4339a910371f108d069250016bcc44cee0be41108b171506a52d41c9e59c770d68032fc042b9675a09e8d33c52df8e0e40d64c65a1c7bc60f820503bd4a283421036f06a1a8469fe4cccab1e4ab673d46c12c80a77d687932f59ee9809a3750169f1db99b4161a2dd3b359869cc4e462d1626a1e90f71c7daae2ec8bebc69b0be45c83f2d395ba2df906b29d2d761c42e4106b4633e47d146ead5f85924527c0d4c8bd2cc956573cee48f36f686079deddcfafea54e87e3e9061f3e454ac7523577a46537d9c6b4b24210e0f5d2a53858fbbf9292bf68d3878b36ed08995ba3b376b45b54b70bb88f862626a3c0927ff4256e2284fc1169a2f5c147752b40cb8782dfa169aff877dea17ed447b8a9fad28ec2d7df1bb26a7437245e4d61679198062a786d07365386cc3e728f70ee5f0cf8bab4b8b3ca1891b9d0e5f94cdc7b7271a6479f287a21058a592d52d247fc60b67a9c1b1a17b46b4e6946c020e5040515a6b4c3fe7b6a4341ecea8e9164c706de1543fb1dfe9e61563535ff9287fd65338b0409d91902d041060b09d0b66e9637b15eb6225f5d06f2c35ed2bcd162d8539423f6ce4a89c0e98b1cfe4b43918e14c75422a3fb38288bb53d441c04376cfc7419a90bf0305429b66a69a18daa836b3f6cf0d8481fc9a4131336584b75797cc89742f47478014db5ad9fc645b55340e6d7d63a79e18e172f28c857868b70ab72d5517a8bd322dadb7e8ab6f952a", 0x1000, 0x8}], 0x1080000, &(0x7f0000001b00)=ANY=[@ANYBLOB="74995ef754432c646973636172642c6e6f6361ca76ed729fdccd2c4ce07a7fc2f852776c615865644a746be8db46b666667365743d020000007d6275670f7175696d742c00353b25c0bab2b31fd26c8773d99caa8288c404a38f088155da2aa66711a76836"]) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000680)='/dev/vcs\x00', 0x400, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f00000006c0)={{0x6, 0x214e}, 'port1\x00', 0x2, 0x10, 0x0, 0x80000000, 0xfffffffeffffffff, 0x2, 0x0, 0x0, 0x5, 0x3}) ioctl$KVM_GET_REG_LIST(r2, 0xc008aeb0, &(0x7f00000001c0)={0x7, [0x2, 0x8, 0x10001, 0x2, 0x2, 0x7, 0x3]}) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) r3 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x135, 0x10c40) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r3, 0x800455d1, &(0x7f0000000440)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) connect(r1, &(0x7f0000000380)=@generic={0x7, "70add7f21a559f6267f69964fed7eca11bb0dfa67ae7f942b0bcc67ce06f5ae3dacf65d607f8514e944d2c2f0e7047af05e9e0f5307140a10e1b343301d557a18ce324e4fdb374818e81d421905da013f6d8f85ee05b7ec988d8f126217abdd4b0dff6bbeddc084bc7d3bdc0f0aeb0ccbc9da064cce235fe025825f7df7e"}, 0x80) r4 = syz_open_dev$mice(&(0x7f0000001a40)='/dev/input/mice\x00', 0x0, 0x40000000001) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000780)=[@in6={0xa, 0x4e21, 0x4, @local={0xfe, 0x80, [], 0xaa}, 0x2}, @in={0x2, 0x4e22, @multicast1=0xe0000001}, @in6={0xa, 0x4e21, 0x2, @mcast1={0xff, 0x1, [], 0x1}, 0x7}, @in6={0xa, 0x4e21, 0x7fff, @loopback={0x0, 0x1}}, @in6={0xa, 0x4e24, 0x100000001, @loopback={0x0, 0x1}, 0xfffffffffffffff9}, @in={0x2, 0x4e24, @multicast1=0xe0000001}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, @in6={0xa, 0x4e20, 0x7fffffff, @remote={0xfe, 0x80, [], 0xbb}, 0x4}, @in6={0xa, 0x4e24, 0x800, @dev={0xfe, 0x80, [], 0x21}, 0x9}, @in={0x2, 0x4e22, @broadcast=0xffffffff}], 0xe8) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) ioctl$KVM_GET_IRQCHIP(r2, 0xc208ae62, &(0x7f0000001940)=@ioapic) writev(r2, &(0x7f0000001ac0)=[{&(0x7f0000000880)="19a509ef5a9821a7383a0b2cbfaf4bd5aa437fa002496a4ede4346a1583c067c93356576883e6b48b5a9231a3074260dc9543240429b28e9fbc7", 0x3a}, {&(0x7f0000001a80)="6ec8c9a09b07e2be1bcc43ae46f87803df5ceffaabbe2d09a82abf26ae390e983f6103ba", 0x24}], 0x2) ioctl$sock_ipx_SIOCAIPXPRISLT(r4, 0x89e1, &(0x7f0000000100)=0x3) rmdir(&(0x7f0000000400)='./file0\x00') ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000640)={0x200, 0x9, 0x5, 0x3ff, 0x2, 0xffffffffffffff7f}) 03:37:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 410.334940] binder: 21976:21977 ioctl c0306201 2000efd0 returned -11 03:37:16 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 410.402396] binder: BINDER_SET_CONTEXT_MGR already set [ 410.416163] binder: BINDER_SET_CONTEXT_MGR already set [ 410.426186] binder: 21987:21989 ioctl 40046207 0 returned -16 03:37:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0x0) dup3(r3, r1, 0x0) 03:37:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x48000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 410.460232] binder: 21988:21990 ioctl 40046207 0 returned -16 [ 410.473905] binder: 21987:21989 ERROR: BC_REGISTER_LOOPER called without request [ 410.496948] binder: 21988:21990 ERROR: BC_REGISTER_LOOPER called without request 03:37:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 410.535429] binder: 21987:21989 transaction failed 29189/-22, size 0-0 line 2852 [ 410.552248] binder: 22003:22004 ioctl c0306201 2000efd0 returned -11 [ 410.554104] binder: 21988:21990 unknown command 0 [ 410.565536] binder: undelivered TRANSACTION_ERROR: 29189 03:37:16 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 410.603558] binder: 21988:21990 ioctl c0306201 2000efd0 returned -22 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(0xffffffffffffffff, r1, 0x0) 03:37:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x2000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:18 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:18 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x10000000) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000200)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000000380)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000040)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00000000c0)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r2, 0x8910, &(0x7f0000000180)=@req={0x28, &(0x7f0000000140)={'syz_tun\x00', @ifru_data=&(0x7f00000000c0)="245e60e028e330681127d5316668d887e9f75b0a9f259bef5bae75c255774fed"}}) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) 03:37:18 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x11, 0x80002, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000000)={{0x2, 0x0, @multicast2=0xe0000002}, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x0, {0x2, 0x0, @loopback=0x7f000001}, 'veth0_to_team\x00'}) syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_GET(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="58001e004e6baa228365fcee40a06520000000000000007369fc7cbd980d167a6259518eb16c2339927169bf3eb3ca2bc1", @ANYBLOB="00062bbd7000fbdbdf2503000000080001004e2000000800020002000000080001004e240000040005000800020002000000080002000a000000080003005e0000000800040001000000080002000a000000"], 0x2}, 0x1, 0x0, 0x0, 0x40001}, 0x4000) r2 = shmget(0x0, 0x1000, 0x1a00, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) [ 412.843586] binder: 22025:22029 ioctl c0306201 2000efd0 returned -11 [ 412.851215] binder: BINDER_SET_CONTEXT_MGR already set [ 412.856795] binder: BINDER_SET_CONTEXT_MGR already set [ 412.870545] binder: 22026:22038 ioctl 40046207 0 returned -16 [ 412.889802] binder: 22034:22037 ioctl 40046207 0 returned -16 [ 412.895413] binder: 22026:22038 ERROR: BC_REGISTER_LOOPER called without request [ 412.903742] binder: 22026:22038 transaction failed 29189/-22, size 0-0 line 2852 [ 412.911349] binder: 22034:22037 ERROR: BC_REGISTER_LOOPER called without request [ 412.912620] binder: 22034:22037 unknown command 0 [ 412.929816] binder: 22034:22037 ioctl c0306201 2000efd0 returned -22 [ 412.938528] binder: undelivered TRANSACTION_ERROR: 29189 03:37:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:23 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4c00, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:23 executing program 6: syz_emit_ethernet(0x66, &(0x7f0000101000)={@link_local={0x1, 0x80, 0xc2}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "02290f", 0x30, 0x3a, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@pkt_toobig={0x5, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, @dev={0xfe, 0x80}}}}}}}}, 0x0) 03:37:23 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, 0xffffffffffffffff, 0x0) 03:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c00000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:23 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000380)={0x3, 0x0, [{0x80000008, 0xffffffffffffff98, 0x8, 0x8, 0x40}, {0x8000000f, 0x3, 0xa6, 0x20000, 0x7ff}, {0xc0000007, 0x4, 0x18a, 0x8, 0x2}]}) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r2 = shmget(0x2, 0x3000, 0x78000828, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0xff) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:23 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:23 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0xffffff7f00000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:23 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004900)=[{{&(0x7f0000001680)=@nfc, 0x80, &(0x7f0000001780)=[{&(0x7f0000001700)=""/91, 0x5b}], 0x1, &(0x7f00000017c0)=""/116, 0x74}}], 0x1, 0x0, &(0x7f0000004a40)) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/anycast6\x00') preadv(r0, &(0x7f0000000140), 0x391, 0x0) [ 418.206346] binder: 22057:22066 ioctl c0306201 2000efd0 returned -11 [ 418.217368] binder: BINDER_SET_CONTEXT_MGR already set [ 418.245810] binder: 22064:22067 ioctl 40046207 0 returned -16 [ 418.255897] binder: 22056:22068 ERROR: BC_REGISTER_LOOPER called without request [ 418.269995] binder: 22064:22067 ERROR: BC_REGISTER_LOOPER called without request 03:37:23 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:23 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 418.312892] binder: BINDER_SET_CONTEXT_MGR already set [ 418.327093] binder: 22056:22068 unknown command 0 [ 418.344894] binder: 22075:22080 ioctl 40046207 0 returned -16 [ 418.356618] binder: 22056:22068 ioctl c0306201 2000efd0 returned -22 [ 418.371189] binder: 22075:22080 ioctl c0306201 2000efd0 returned -11 03:37:24 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 418.437143] binder: release 22064:22067 transaction 347 out, still active [ 418.444187] binder: undelivered TRANSACTION_COMPLETE [ 418.491387] binder: send failed reply for transaction 347, target dead [ 418.531630] binder: 22097:22098 ERROR: BC_REGISTER_LOOPER called without request [ 418.571531] binder: 22097:22098 unknown command 0 [ 418.590311] binder: 22097:22098 ioctl c0306201 2000efd0 returned -22 [ 419.013684] binder: 22064:22105 ERROR: BC_REGISTER_LOOPER called without request [ 419.028689] binder_alloc: 22064: binder_alloc_buf, no vma [ 419.034401] binder: 22064:22104 transaction failed 29189/-3, size 0-0 line 2967 [ 419.058543] binder: undelivered TRANSACTION_ERROR: 29189 03:37:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x500000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:35 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={r0}) sendmsg$nl_crypto(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=@delrng={0x10, 0x14, 0xf01, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x1}, 0x4000004) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) listxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200), 0x0) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:35 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:35 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB='\a\x00\x00\x00']}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:35 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000)=0x9e1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 429.612689] binder: 22114:22120 unknown command 7 [ 429.626575] binder: BINDER_SET_CONTEXT_MGR already set [ 429.638101] binder: 22114:22120 ioctl c0306201 204edfd0 returned -22 [ 429.647387] binder: 22119:22121 ioctl 40046207 0 returned -16 03:37:35 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:35 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000440)={0x0, 0x7, 0x6, 0x8, 0x6, 0x2, 0x100000001, 0xfffffffffffffff7, {0x0, @in={{0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x8, 0x7fffffff, 0xa0, 0xffff, 0x800}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000380)={r2, 0x330}, 0x8) [ 429.664814] binder: release 22114:22120 transaction 352 out, still active [ 429.671880] binder: undelivered TRANSACTION_COMPLETE [ 429.701680] binder: 22119:22121 ERROR: BC_REGISTER_LOOPER called without request [ 429.730192] binder: release 22119:22121 transaction 353 out, still active [ 429.737357] binder: undelivered TRANSACTION_COMPLETE 03:37:35 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 429.780483] binder: BINDER_SET_CONTEXT_MGR already set [ 429.795729] binder: 22123:22129 ioctl 40046207 0 returned -16 [ 429.817290] binder: 22123:22129 ioctl c0306201 2000efd0 returned -11 03:37:35 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6800, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 429.926601] binder: BINDER_SET_CONTEXT_MGR already set [ 429.948939] binder: 22134:22136 ioctl 40046207 0 returned -16 [ 429.972925] binder: 22134:22136 ioctl c0306201 2000efd0 returned -11 [ 429.981178] binder: BINDER_SET_CONTEXT_MGR already set [ 429.994135] binder: 22138:22139 ioctl 40046207 0 returned -16 [ 430.011459] binder: 22138:22139 ERROR: BC_REGISTER_LOOPER called without request [ 430.024792] binder: 22138:22139 unknown command 0 [ 430.029752] binder: 22138:22139 ioctl c0306201 2000efd0 returned -22 [ 430.406249] binder: send failed reply for transaction 352, target dead [ 430.413112] binder: send failed reply for transaction 353, target dead 03:37:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4800, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000200)={{0x2, 0x1ff}, 'port1\x00', 0x20, 0x50000, 0x1f, 0x5, 0xffffffff, 0x8000, 0x8, 0x0, 0x1, 0x401}) r2 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b6300d8c83b8d8f6b5644523f24af9a3200"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0200000000000000"], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r2, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:37 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x7, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000200), 0x4) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000480)='./file0/file0\x00', &(0x7f0000000500)='bdev\x00', 0x100000, &(0x7f00000003c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000340)) 03:37:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000)=0x9e1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xfdfd, &(0x7f00000001c0)}) 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 431.963668] binder: 22168:22169 unknown command -671063285 [ 431.989434] binder: 22168:22169 ioctl c0306201 204edfd0 returned -22 [ 432.022336] binder: release 22168:22169 transaction 355 out, still active [ 432.029495] binder: undelivered TRANSACTION_COMPLETE [ 432.054881] binder: BINDER_SET_CONTEXT_MGR already set [ 432.065669] binder: BINDER_SET_CONTEXT_MGR already set [ 432.078117] binder: 22167:22175 ioctl 40046207 0 returned -16 [ 432.083165] binder: BINDER_SET_CONTEXT_MGR already set [ 432.089738] binder: BINDER_SET_CONTEXT_MGR already set [ 432.091707] binder: 22166:22176 ioctl 40046207 0 returned -16 [ 432.095387] binder: 22165:22171 ioctl 40046207 0 returned -16 [ 432.105660] binder: 22154:22178 ioctl 40046207 0 returned -16 [ 432.115742] binder: 22167:22175 ERROR: BC_REGISTER_LOOPER called without request 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 432.126662] binder: 22165:22171 ERROR: BC_REGISTER_LOOPER called without request [ 432.129803] binder: 22166:22176 ERROR: BC_REGISTER_LOOPER called without request [ 432.141761] binder: release 22165:22171 transaction 356 out, still active [ 432.148862] binder: undelivered TRANSACTION_COMPLETE [ 432.158367] binder: 22154:22178 ioctl c0306201 2000efd0 returned -11 [ 432.161995] binder: 22167:22175 unknown command 0 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x600, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 432.205972] binder: 22167:22175 ioctl c0306201 2000efd0 returned -22 03:37:37 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendmmsg(r1, &(0x7f0000005f40)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000001600)=[{0x10}], 0x10}}], 0x4000350, 0x7ffffff7) 03:37:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xfffffffe, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 432.253131] binder: BINDER_SET_CONTEXT_MGR already set [ 432.261298] binder: release 22166:22176 transaction 357 out, still active [ 432.268568] binder: undelivered TRANSACTION_COMPLETE 03:37:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:37 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 432.321849] binder: 22191:22193 ioctl 40046207 0 returned -16 [ 432.343189] binder: BINDER_SET_CONTEXT_MGR already set 03:37:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 432.373223] binder: 22201:22202 ioctl 40046207 0 returned -16 [ 432.387230] binder: 22191:22193 ioctl c0306201 2000efd0 returned -11 [ 432.398833] binder: 22201:22202 ERROR: BC_REGISTER_LOOPER called without request [ 432.421744] binder: 22201:22202 unknown command 0 [ 432.427593] binder: 22201:22202 ioctl c0306201 2000efd0 returned -22 [ 432.741982] binder: send failed reply for transaction 355, target dead [ 432.748756] binder: send failed reply for transaction 356, target dead [ 432.755532] binder: send failed reply for transaction 357, target dead 03:37:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x130e0000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xffffff7f00000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b63122f0000"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) syz_emit_ethernet(0xc4, &(0x7f0000000440)={@random="285154c74291", @random="d261aa165070", [], {@llc={0x4, {@snap={0xaa, 0xab, "17", "07489a", 0x6005, "8a8d34947c33e42f09fc6f31099f94dd1604455a88be1e41f58564f195afc97eca05831911a22446e0aaf5d56c92a923f3a834677090bf45e406cd0e877ebb3952a7dab5ff5ab2d0a4599288e69934a6e00e650486132b981e8279dcb1fe639c528cab8f9cb8a61e26ff790222d4b5433a82501570816542b7e59ebeb7c572984e1cd4b74233ee947616f6894fbf345413eb61fa7d0aae705cf0611b7b229bb11382b6e711196cd4c8d79982d1b3"}}}}}, &(0x7f0000000200)={0x1, 0x1, [0x820, 0x2b3, 0x3e1, 0x41d]}) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) r1 = syz_open_dev$sndpcmc(&(0x7f0000000380)='/dev/snd/pcmC#D#c\x00', 0x2e, 0x240000) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f00000003c0)={0x5, &(0x7f0000000540)=[{0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @link_local}, {}]}) rmdir(&(0x7f0000000400)='./file0\x00') socketpair$ax25(0x3, 0x3, 0xcc, &(0x7f0000000100)) 03:37:38 executing program 6: 03:37:38 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000)=0x9e1, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:38 executing program 6: [ 432.965859] binder: BINDER_SET_CONTEXT_MGR already set [ 432.973192] binder: BINDER_SET_CONTEXT_MGR already set [ 432.981708] binder: 22226:22228 ERROR: BC_REGISTER_LOOPER called without request [ 432.990349] binder: BINDER_SET_CONTEXT_MGR already set [ 432.990619] binder: 22229:22236 ioctl 40046207 0 returned -16 [ 433.002377] binder: 22233:22234 ioctl 40046207 0 returned -16 [ 433.005167] binder: 22227:22235 ioctl 40046207 0 returned -16 03:37:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 433.016062] binder: 22226:22228 unknown command 0 [ 433.022843] binder: 22233:22234 ioctl c0306201 2000efd0 returned -11 [ 433.029950] binder: 22227:22235 unknown command 789734171 [ 433.033727] binder: 22229:22236 ERROR: BC_REGISTER_LOOPER called without request [ 433.043766] binder: 22226:22228 ioctl c0306201 2000efd0 returned -22 [ 433.047687] binder: 22227:22235 ioctl c0306201 204edfd0 returned -22 03:37:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x7400, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x74, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:38 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080), 0x4) [ 433.077603] binder_alloc: 22226: binder_alloc_buf failed to map pages in userspace, no vma [ 433.086180] binder: 22229:22236 transaction failed 29189/-3, size 0-0 line 2967 03:37:38 executing program 6: [ 433.147598] binder: 22227:22235 transaction failed 29189/-22, size 0-0 line 2852 [ 433.166266] binder: 22251:22252 ERROR: BC_REGISTER_LOOPER called without request [ 433.168824] binder: BINDER_SET_CONTEXT_MGR already set [ 433.200607] binder: undelivered TRANSACTION_ERROR: 29189 [ 433.206439] binder: undelivered TRANSACTION_ERROR: 29189 [ 433.215883] binder: 22251:22252 unknown command 0 [ 433.220477] binder: 22250:22253 ioctl 40046207 0 returned -16 [ 433.237466] binder: 22251:22252 ioctl c0306201 2000efd0 returned -22 [ 433.248127] binder: 22250:22253 ioctl c0306201 2000efd0 returned -11 [ 433.780849] binder: 22227:22263 unknown command 789734171 [ 433.788008] binder: release 22227:22264 transaction 363 out, still active [ 433.795059] binder: undelivered TRANSACTION_COMPLETE [ 433.799898] binder: 22227:22263 ioctl c0306201 204edfd0 returned -22 [ 433.817091] binder: send failed reply for transaction 363, target dead 03:37:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) ioctl(r0, 0x5, &(0x7f0000000040)="295ee10200ff0000001070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:40 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:40 executing program 4: r0 = memfd_create(&(0x7f000088f000)='\x00\x00\x00', 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000040)) getpeername$unix(0xffffffffffffffff, &(0x7f00000001c0)=@abs, &(0x7f0000000240)=0x6e) fstat(0xffffffffffffff9c, &(0x7f0000000280)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000300), &(0x7f0000000340)=0x8) setuid(0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x1000000) read(r0, &(0x7f0000000000)=""/48, 0xfffffe18) 03:37:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x5, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:40 executing program 7: io_setup(0x4, &(0x7f0000000040)=0x0) io_getevents(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0) 03:37:40 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$inet(0xffffffffffffffff, &(0x7f0000000580), &(0x7f00000005c0)=0x10, 0x80000) accept$inet(r2, &(0x7f0000000600)={0x0, 0x0, @broadcast}, &(0x7f0000000640)=0x10) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) r3 = fanotify_init(0x2, 0x2) r4 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x0, 0x101000) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x83, &(0x7f00000004c0)={'nat\x00', 0x0, 0x4, 0x72, [], 0x7, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000440)=""/114}, &(0x7f0000000200)=0x78) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) r5 = add_key$keyring(&(0x7f0000000680)='keyring\x00', &(0x7f00000006c0)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, r5) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) sendfile(r3, r1, &(0x7f0000000540)=0x2d, 0x1) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 435.213898] binder: 22278:22281 ioctl c0306201 2000efd0 returned -11 03:37:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x20000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 435.320125] binder: 22288:22289 ERROR: BC_REGISTER_LOOPER called without request [ 435.337124] binder: BINDER_SET_CONTEXT_MGR already set [ 435.356846] binder: BINDER_SET_CONTEXT_MGR already set [ 435.364651] binder: 22288:22289 unknown command 0 03:37:40 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 435.366947] binder: 22291:22292 ioctl 40046207 0 returned -16 03:37:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 435.392884] binder: 22295:22297 ioctl 40046207 0 returned -16 [ 435.394458] binder: 22291:22292 ERROR: BC_REGISTER_LOOPER called without request [ 435.406601] binder: 22288:22289 ioctl c0306201 2000efd0 returned -22 [ 435.416748] binder: 22291:22292 ioctl 5 20000040 returned -22 [ 435.427602] binder: 22295:22297 ioctl c0306201 2000efd0 returned -11 [ 435.432650] binder: release 22291:22292 transaction 366 out, still active [ 435.441226] binder: undelivered TRANSACTION_COMPLETE 03:37:41 executing program 4: r0 = socket$inet_sctp(0x2, 0x9, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x0, @empty, 0x4e22, 0x4, 'sed\x00', 0x10, 0x3, 0x56}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x2}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000080)=0x1e) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f00000002c0), 0x4cc, 0x0) 03:37:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x5000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x600000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 435.477766] binder: send failed reply for transaction 366, target dead [ 435.525310] binder: 22306:22312 ERROR: BC_REGISTER_LOOPER called without request [ 435.550060] binder: BINDER_SET_CONTEXT_MGR already set [ 435.567360] binder: 22314:22315 ioctl 40046207 0 returned -16 [ 435.577703] binder: 22306:22312 unknown command 0 [ 435.586360] binder: 22306:22312 ioctl c0306201 2000efd0 returned -22 [ 435.594878] binder: 22314:22315 ioctl c0306201 2000efd0 returned -11 [ 436.143569] binder: 22291:22331 ERROR: BC_REGISTER_LOOPER called without request [ 436.154599] binder: 22291:22331 ioctl 5 20000040 returned -22 [ 436.154613] binder_alloc: 22291: binder_alloc_buf, no vma [ 436.154643] binder: 22291:22330 transaction failed 29189/-3, size 0-0 line 2967 [ 436.173740] binder: undelivered TRANSACTION_ERROR: 29189 03:37:41 executing program 7: 03:37:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x500, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:41 executing program 4: 03:37:41 executing program 6: 03:37:41 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x5d548ee802eab56b) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="dd7092bdd5fa7a3e435c0f2706bf7cc61e677468e4bb002f9b0aeac5c8a340118268dd96b84b156db1db5ab4981d7bf6c190247c0735eb47122a601947f76c0c5f9fecac11d9f6f931e52fc453fcf48207320c03c41c30f501b1b19e5753c2bd8f"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f00004ee64e)}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xc, 0x2010, r0, 0x3e) r2 = socket$inet6(0xa, 0x1, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000000c0)) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:41 executing program 4: 03:37:41 executing program 6: 03:37:41 executing program 7: [ 436.313758] binder: 22336:22337 ERROR: BC_REGISTER_LOOPER called without request [ 436.315512] binder: BINDER_SET_CONTEXT_MGR already set [ 436.339122] binder: BINDER_SET_CONTEXT_MGR already set 03:37:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 436.361451] binder: 22336:22337 unknown command 0 [ 436.366500] binder: 22335:22343 ioctl 40046207 0 returned -16 [ 436.373385] binder: 22346:22347 ioctl 40046207 0 returned -16 [ 436.374871] binder: 22336:22337 ioctl c0306201 2000efd0 returned -22 03:37:41 executing program 4: [ 436.408597] binder: 22335:22343 ioctl c0306201 2000efd0 returned -11 [ 436.424983] binder: 22346:22347 unknown command -1114476323 03:37:42 executing program 6: 03:37:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x3, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:42 executing program 7: [ 436.455836] binder: 22346:22347 ioctl c0306201 204edfd0 returned -22 [ 436.577566] binder: 22367:22368 ERROR: BC_REGISTER_LOOPER called without request [ 436.589773] binder: 22367:22368 unknown command 0 [ 436.603286] binder: 22367:22368 ioctl c0306201 2000efd0 returned -22 [ 438.444336] binder: 22379:22381 ERROR: BC_REGISTER_LOOPER called without request [ 438.482608] binder: 22379:22381 unknown command 0 03:37:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x7a00, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:43 executing program 4: 03:37:43 executing program 6: 03:37:43 executing program 7: 03:37:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x68, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:43 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) r1 = syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x100000000, 0x80000) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000380)={0x7, 0x9, 0x101}) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) mkdir(&(0x7f0000000100)='./file0/file0\x00', 0x140) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="a10b949b88be77c79b63fee5cbada22d6bbfd6fc99977dcc49e317fe805b69e5eeb47c76f657816d2c086a611b0c1e2acd1f37310e1542a7ca21edba089a781ca9892c0ba9e0f9d8b32610444e7250e9203a8ceaacb19592c58817092b1cd694bbb0cc282b431b7f93c804be68138992f5569e75c56bc47e68846a51cd25d4f5a5b2da2639ae2f1298b597761244e7e33b59fb70c0142c0b54c0933057c819004e728f7c53591ca0bbbf7c44fe5a093098a78c"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:44 executing program 6: 03:37:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 438.497118] binder: 22379:22381 ioctl c0306201 2000efd0 returned -22 03:37:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:44 executing program 7: 03:37:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:44 executing program 6: [ 438.648046] binder: 22392:22394 ERROR: BC_REGISTER_LOOPER called without request [ 438.654961] binder: BINDER_SET_CONTEXT_MGR already set [ 438.663742] binder: BINDER_SET_CONTEXT_MGR already set [ 438.674389] binder: 22385:22398 ioctl 40046207 0 returned -16 [ 438.690486] binder: 22384:22397 ioctl 40046207 0 returned -16 [ 438.696256] binder: 22385:22398 unknown command -1684796511 [ 438.707469] binder: 22392:22394 unknown command 0 [ 438.714530] binder: 22385:22398 ioctl c0306201 204edfd0 returned -22 [ 438.720543] binder: 22392:22394 ioctl c0306201 2000efd0 returned -22 [ 438.733187] binder: 22384:22397 ioctl c0306201 2000efd0 returned -11 [ 438.739655] binder: 22385:22398 unknown command 32 [ 438.753408] binder: 22385:22398 ioctl c0306201 20007000 returned -22 03:37:46 executing program 7: 03:37:46 executing program 6: 03:37:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:46 executing program 7: 03:37:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:46 executing program 4: 03:37:46 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000380), &(0x7f00000003c0)=0x14, 0x800) getpeername$packet(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000480)=0x14) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f0000000100)='./file1\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) fcntl$setflags(r1, 0x2, 0x1) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000200)={0x6, {{0x2, 0x4e22, @broadcast=0xffffffff}}, 0x0, 0x8, [{{0x2, 0x4e24, @multicast1=0xe0000001}}, {{0x2, 0x4e21, @multicast1=0xe0000001}}, {{0x2, 0x4e20, @rand_addr=0x5}}, {{0x2, 0x4e21, @broadcast=0xffffffff}}, {{0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e23, @multicast2=0xe0000002}}, {{0x2, 0x4e20, @multicast1=0xe0000001}}, {{0x2, 0x4e24, @broadcast=0xffffffff}}]}, 0x490) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:46 executing program 6: [ 440.733530] binder: 22425:22426 ERROR: BC_REGISTER_LOOPER called without request 03:37:46 executing program 7: 03:37:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 440.787188] binder: release 22425:22426 transaction 375 out, still active [ 440.794289] binder: undelivered TRANSACTION_COMPLETE [ 440.801879] binder: send failed reply for transaction 375, target dead 03:37:46 executing program 4: 03:37:46 executing program 6: [ 440.865639] binder: 22425:22426 ioctl c0306201 2000efd0 returned -14 [ 440.872722] binder: BINDER_SET_CONTEXT_MGR already set [ 440.890296] binder: 22433:22435 ioctl 40046207 0 returned -16 03:37:46 executing program 7: [ 440.928535] binder: 22433:22435 ioctl c0306201 2000efd0 returned -11 [ 440.937531] binder: BINDER_SET_CONTEXT_MGR already set [ 440.943293] binder: 22429:22440 ioctl 40046207 0 returned -16 03:37:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 440.982999] binder: 22429:22440 ERROR: BC_REGISTER_LOOPER called without request [ 441.054974] binder: 22429:22440 unknown command 0 [ 441.060556] binder: 22450:22451 ERROR: BC_REGISTER_LOOPER called without request [ 441.082558] binder: 22429:22440 ioctl c0306201 2000efd0 returned -22 [ 441.091897] binder: 22450:22451 transaction failed 29189/-22, size 0-0 line 2852 [ 441.109855] binder: undelivered TRANSACTION_ERROR: 29189 03:37:47 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000d51eed)={@link_local={0x1, 0x80, 0xc2}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @broadcast=0xffffffff}, @gre={{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x8, 0x880b}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd}, {0x0, 0x21}}}}}}, 0x0) 03:37:47 executing program 7: 03:37:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x68, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:47 executing program 6: 03:37:47 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) accept4(r0, &(0x7f0000000380)=@l2, &(0x7f0000000100)=0x80, 0x80800) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="8ea0359f", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x50, r0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:47 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="010000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e0000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414000000000000000000005cb3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1) 03:37:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) dup3(r1, r2, 0x0) 03:37:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 441.975750] binder: BINDER_SET_CONTEXT_MGR already set [ 441.981682] binder: BINDER_SET_CONTEXT_MGR already set [ 441.981808] binder: 22463:22464 ioctl c0306201 2000efd0 returned -11 [ 442.003259] binder: 22460:22467 ioctl 40046207 0 returned -16 [ 442.013527] binder: 22462:22469 ioctl 40046207 0 returned -16 [ 442.054912] binder: 22460:22467 ERROR: BC_REGISTER_LOOPER called without request [ 442.067075] binder: 22462:22469 ERROR: BC_REGISTER_LOOPER called without request [ 442.106080] binder: 22462:22469 unknown command 0 03:37:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x5, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) 03:37:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:47 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x4000000000000001) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in=@dev={0xac, 0x14, 0x14}, 0x0, 0x2b}, 0x0, @in=@broadcast=0xffffffff}}, 0xe8) [ 442.127348] binder: 22462:22469 ioctl c0306201 2000efd0 returned -22 [ 442.136386] binder: 22460:22467 unknown command -1623875442 [ 442.165800] binder: 22460:22467 ioctl c0306201 20007000 returned -22 03:37:47 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000000)={0x8, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) 03:37:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 442.192560] binder: 22489:22490 ioctl c0306201 2000efd0 returned -11 03:37:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$netlink(0x10, 0x3, 0x8008000100000004) writev(r1, &(0x7f00007af000)=[{&(0x7f0000000000)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 03:37:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x36]}, 0x5) [ 442.289339] binder: BINDER_SET_CONTEXT_MGR already set [ 442.326505] binder: 22505:22506 ioctl 40046207 0 returned -16 [ 442.361303] binder: 22505:22506 ERROR: BC_REGISTER_LOOPER called without request [ 442.390479] binder: 22505:22506 unknown command 0 [ 442.397826] binder: 22505:22506 ioctl c0306201 2000efd0 returned -22 03:37:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4800000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:49 executing program 4 (fault-call:7 fault-nth:0): r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:49 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:49 executing program 7 (fault-call:4 fault-nth:0): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6800000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x34, 0x2f, 0x36]}, 0x3) 03:37:49 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000900)='./file0\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x4c02, 0x7, &(0x7f00000007c0)=[{&(0x7f0000000380)="4789afbd79478b93f79b1dfd6797757bfea96577b61746afb2f13783ff77eded3c434361c876f35799cfb02f5745be850c4d495efe", 0x35, 0x20}, {&(0x7f0000000440)="e8d825a128b361c675c54ff0688aa9f812bf9ac2e458a546ac6a534dcec23f5df465009cfadc3b3e63ddd9469f71c266f904a9069b06fbb6af5b08c81ddc5f9f2d97ddc31599a3ac2608e0a1bbac1dbcab39d96e70e2dfb88cf2b1cc5892cbb7aa09b7", 0x63, 0x8}, {&(0x7f00000004c0)="1e367d346924807a7995bbe2a03c96349219e1a10e9691cce0cfd20df67575370e4e7d4a2fbc440934710286855263aae21a0278123fbc7437ac2875157a6f067dd076e737da9c8f8b4fd2f3fcf49f90ad329fcb62e0ba69f55fb2b1", 0x5c, 0x5965}, {&(0x7f0000000540)="4f02dcd0bd77c7d524ddbe58c3b943609e0a3125e4d3396599ab7b7ddc8320a818ab2c753c0cfd485ce713b7e987ac700ef96acd033669bc57224abb9dfb8d6f9b314939830bdab85b1b6496d31b6e760823a1317230804c1c4829e4bb931dcb695e1e7ee9e5b42bb78eb51312d49ae0d262781d5de96705013162d4b106e1305aaeca7b369c1df02807910c78b504f55d8c699a1702156b032b2fcc9e9f24dd0dc49ecf2dff", 0xa6, 0xffffffffffff0966}, {&(0x7f0000000600)="d8da3ae6b83f9dc7faa31d6d5ba708878e819164efa7f2e53757511ee8087759cbebfac446866b27ef78c2a9aa5b07053926269412c40c56ee9e127ce4a33fbce32e9939cc5642f2415c58b7e69efa6d7650a25cab1dcde76d65f61ed1a1942aad83ab6dfec105e477089de831c2bf2e01cd670aeaaef06e8171e4bfa2bfc4852ad786bc85a28824bd00af0a4034e276a22e67b5f85d8de90ff77f788bf33a87be6790c333c953ffe6af5b32f018d60d7e9e9fdad7a7366462f7dcd6f3161c42574c5ac22c467ca2aae54fe3c203f12691e7856aa74865e836b413bd8d4f451832d36ca4eafee465ee578275025efd07", 0xf0, 0x3}, {&(0x7f0000000700)="5c186d7e7c9b61de81d173c53aca093b2d06d09de3900a7a83a0f481e1d6edb4f54c23036b3b49bb47351f6b44a7fe935419ee17f90dca05c52392a4596ba7263ff81aa1441a3b7512b10ff05a66936b946874251b47e60924ba3579e97cd909ed76855b3efac57c30c74e4523b053219304f6bbe3414e8ee69d5f1e8531f25024b0c7910a16fb717e3365adf6dd1f641df6ec51e8ccf77d5b54117aaa79b9794119d1ef9f7b6d21", 0xa8, 0x3}, {&(0x7f00000003c0)="f941d866f61a88fe9e32423d648e24078b09ee31be3f7215", 0x18, 0xffff}], 0x400, &(0x7f0000000880)={[{@discard='discard', 0x2c}]}) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mkdir(&(0x7f0000000940)='./file0\x00', 0x20) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fadvise64(r1, 0x0, 0x2, 0x7) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 444.187367] FAULT_INJECTION: forcing a failure. [ 444.187367] name failslab, interval 1, probability 0, space 0, times 0 [ 444.199066] CPU: 1 PID: 22527 Comm: syz-executor7 Not tainted 4.17.0+ #91 [ 444.200147] binder: BINDER_SET_CONTEXT_MGR already set [ 444.205995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 444.206012] Call Trace: [ 444.206036] dump_stack+0x1b9/0x294 [ 444.206059] ? dump_stack_print_info.cold.2+0x52/0x52 [ 444.216733] binder: 22529:22534 ERROR: BC_REGISTER_LOOPER called without request [ 444.220715] ? graph_lock+0x170/0x170 [ 444.220736] ? __lock_acquire+0x7f5/0x5140 [ 444.220752] ? xsk_setsockopt+0x392/0x550 [ 444.220773] should_fail.cold.4+0xa/0x1a [ 444.240627] binder: release 22529:22534 transaction 381 out, still active [ 444.243885] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 444.243905] ? find_held_lock+0x36/0x1c0 [ 444.243923] ? graph_lock+0x170/0x170 [ 444.243943] ? find_held_lock+0x36/0x1c0 [ 444.247750] binder: undelivered TRANSACTION_COMPLETE [ 444.251969] ? __lock_is_held+0xb5/0x140 [ 444.251996] ? check_same_owner+0x320/0x320 [ 444.256824] binder: send failed reply for transaction 381, target dead [ 444.260179] ? rcu_note_context_switch+0x710/0x710 [ 444.260196] ? lock_downgrade+0x8e0/0x8e0 [ 444.260217] __should_failslab+0x124/0x180 [ 444.260236] should_failslab+0x9/0x14 [ 444.273592] binder: 22532:22536 ioctl 40046207 0 returned -16 [ 444.276300] kmem_cache_alloc_trace+0x2cb/0x780 [ 444.276318] ? __might_sleep+0x95/0x190 [ 444.276340] xskq_create+0x4d/0x190 [ 444.276354] xsk_init_queue+0x7d/0xf0 [ 444.276371] xsk_setsockopt+0x422/0x550 [ 444.347106] ? xsk_init_queue+0xf0/0xf0 [ 444.351072] ? __lock_is_held+0xb5/0x140 [ 444.355130] ? security_socket_setsockopt+0x94/0xc0 [ 444.360147] __sys_setsockopt+0x1bd/0x390 [ 444.364287] ? kernel_accept+0x310/0x310 [ 444.368333] ? ksys_write+0x1a6/0x250 [ 444.372136] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 444.377662] __x64_sys_setsockopt+0xbe/0x150 [ 444.382059] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 444.387066] do_syscall_64+0x1b1/0x800 [ 444.390939] ? finish_task_switch+0x1ca/0x840 [ 444.395419] ? syscall_return_slowpath+0x5c0/0x5c0 [ 444.400335] ? syscall_return_slowpath+0x30f/0x5c0 [ 444.405254] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 444.410609] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 444.415450] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 444.420623] RIP: 0033:0x4559f9 03:37:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x0, 0x34, 0x2f, 0x36]}, 0x5) [ 444.423802] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 444.443042] RSP: 002b:00007f85577c4c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 444.450746] RAX: ffffffffffffffda RBX: 00007f85577c56d4 RCX: 00000000004559f9 [ 444.458013] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000013 [ 444.465279] RBP: 000000000072bea0 R08: 0000000000000004 R09: 0000000000000000 [ 444.472533] R10: 0000000020000080 R11: 0000000000000246 R12: 0000000000000015 [ 444.479795] R13: 00000000004c60a8 R14: 00000000004d0d60 R15: 0000000000000000 [ 444.490602] binder: 22529:22534 ioctl c0306201 2000efd0 returned -14 [ 444.492092] binder: BINDER_SET_CONTEXT_MGR already set [ 444.500144] binder: 22532:22536 ERROR: BC_REGISTER_LOOPER called without request [ 444.515668] binder: 22532:22536 unknown command 0 [ 444.526369] binder: 22532:22536 ioctl c0306201 2000efd0 returned -22 03:37:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x109000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r2, 0x4010ae74, &(0x7f0000000040)={0x9, 0x6, 0x1488}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:50 executing program 7 (fault-call:4 fault-nth:1): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4000000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0xea03000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:50 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) [ 444.545530] binder: 22530:22531 ioctl 40046207 0 returned -16 [ 444.557893] binder: 22530:22531 ioctl c0306201 2000efd0 returned -11 [ 444.779542] binder: 22542:22551 ioctl c0306201 2000efd0 returned -11 [ 444.785302] binder: BINDER_SET_CONTEXT_MGR already set [ 444.800840] binder: BINDER_SET_CONTEXT_MGR already set [ 444.815617] binder: 22541:22555 ioctl 40046207 0 returned -16 [ 444.844352] binder: 22554:22556 ioctl 40046207 0 returned -16 [ 444.848633] binder: 22541:22555 ERROR: BC_REGISTER_LOOPER called without request [ 444.865192] FAULT_INJECTION: forcing a failure. [ 444.865192] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 444.869365] binder: 22541:22555 unknown command 0 [ 444.877262] CPU: 0 PID: 22557 Comm: syz-executor7 Not tainted 4.17.0+ #91 [ 444.882560] binder: 22541:22555 ioctl c0306201 2000efd0 returned -22 [ 444.889329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 444.889336] Call Trace: [ 444.889365] dump_stack+0x1b9/0x294 [ 444.889386] ? dump_stack_print_info.cold.2+0x52/0x52 [ 444.889406] ? lock_downgrade+0x8e0/0x8e0 [ 444.889428] should_fail.cold.4+0xa/0x1a [ 444.889442] ? rcu_is_watching+0x85/0x140 [ 444.889462] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 444.901554] binder: 22554:22556 ERROR: BC_REGISTER_LOOPER called without request [ 444.905345] ? graph_lock+0x170/0x170 [ 444.905373] ? is_bpf_text_address+0xd7/0x170 [ 444.905392] ? find_held_lock+0x36/0x1c0 [ 444.915464] binder: 22554:22556 transaction failed 29189/-22, size 0-0 line 2852 [ 444.916784] ? __lock_is_held+0xb5/0x140 [ 444.916813] ? check_same_owner+0x320/0x320 [ 444.916829] ? save_stack+0x43/0xd0 [ 444.916854] ? rcu_note_context_switch+0x710/0x710 [ 444.916872] ? xsk_setsockopt+0x422/0x550 [ 444.930622] binder: undelivered TRANSACTION_ERROR: 29189 [ 444.934307] ? __sys_setsockopt+0x1bd/0x390 [ 444.934325] ? __might_sleep+0x95/0x190 [ 444.934345] __alloc_pages_nodemask+0x34e/0xd70 [ 444.934362] ? find_held_lock+0x36/0x1c0 [ 444.934378] ? __alloc_pages_slowpath+0x2d50/0x2d50 [ 444.934392] ? __lock_is_held+0xb5/0x140 [ 444.934424] ? __lock_is_held+0xb5/0x140 [ 445.018356] ? xskq_create+0x4d/0x190 [ 445.022148] ? rcu_read_lock_sched_held+0x108/0x120 [ 445.027169] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 445.032698] alloc_pages_current+0x10c/0x210 [ 445.037099] ? __might_sleep+0x95/0x190 [ 445.041067] __get_free_pages+0xf/0x40 [ 445.044950] xskq_create+0xfe/0x190 [ 445.048580] xsk_init_queue+0x7d/0xf0 [ 445.052370] xsk_setsockopt+0x422/0x550 [ 445.056346] ? xsk_init_queue+0xf0/0xf0 [ 445.060315] ? __lock_is_held+0xb5/0x140 [ 445.064376] ? security_socket_setsockopt+0x94/0xc0 [ 445.069422] __sys_setsockopt+0x1bd/0x390 [ 445.073579] ? kernel_accept+0x310/0x310 [ 445.077655] ? ksys_write+0x1a6/0x250 [ 445.081486] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 445.087043] __x64_sys_setsockopt+0xbe/0x150 [ 445.091475] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 445.096488] do_syscall_64+0x1b1/0x800 [ 445.100385] ? finish_task_switch+0x1ca/0x840 [ 445.104906] ? syscall_return_slowpath+0x5c0/0x5c0 [ 445.109857] ? syscall_return_slowpath+0x30f/0x5c0 [ 445.114802] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 445.120184] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 445.125044] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 445.130245] RIP: 0033:0x4559f9 [ 445.133430] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 445.152790] RSP: 002b:00007f85577c4c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 445.160501] RAX: ffffffffffffffda RBX: 00007f85577c56d4 RCX: 00000000004559f9 [ 445.167771] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000013 [ 445.175035] RBP: 000000000072bea0 R08: 0000000000000004 R09: 0000000000000000 [ 445.182332] R10: 0000000020000080 R11: 0000000000000246 R12: 0000000000000015 [ 445.189603] R13: 00000000004c60a8 R14: 00000000004d0d60 R15: 0000000000000001 03:37:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x2f, 0x36]}, 0x3) 03:37:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6800000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7400, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:51 executing program 7 (fault-call:4 fault-nth:2): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fchdir(r1) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xffffffffffffffc7, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB="0b9a0000"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = dup3(r1, r0, 0x0) r4 = mmap$binder(&(0x7f0000013000/0x3000)=nil, 0x3000, 0x2000007, 0x58e896fc61a22b91, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x39a, 0x0, &(0x7f0000000340)=[@transaction={0x40406300, {0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@flat={0x77622a85, 0x10a, r4}], &(0x7f0000000180)=[0x40, 0x28, 0x78, 0x38, 0x38, 0x30]}}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)=[0x30]}, 0x2d}}, @exit_looper={0x630d}, @register_looper={0x630b}], 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) accept$packet(r3, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000002c0)=0x14) sendto$packet(r3, &(0x7f0000000000)="e2ce03eb7e43659d011d43dd2af5f18f3960836953b14f70771da7529af09c420f1ca7fdbab7fab0e78c0324f945b7af525528de3a76393f101f12d5a9bfbf844a3a79e9b62ec43abd3a12c821264ee4ea2744aabd6a77f7e4282d69c8ea39c625", 0x61, 0x44800, &(0x7f0000000300)={0x11, 0xf5, r5, 0x1, 0x6, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x14) 03:37:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x0) 03:37:51 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) sysfs$1(0x1, &(0x7f0000000100)='ramfs\x00') mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') [ 445.620742] binder: 22571:22576 ioctl c0306201 2000efd0 returned -11 [ 445.624751] binder: BINDER_SET_CONTEXT_MGR already set [ 445.651156] binder: 22572:22579 ioctl 40046207 0 returned -16 [ 445.660281] binder: BINDER_SET_CONTEXT_MGR already set 03:37:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x0, 0x2f, 0x36]}, 0x5) 03:37:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', 0xffffffffffffffff, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', 0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0x2) 03:37:51 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 445.671323] binder: 22582:22583 ioctl 40046207 0 returned -16 [ 445.682386] binder: 22572:22579 ERROR: BC_REGISTER_LOOPER called without request [ 445.690796] binder_alloc: 22571: binder_alloc_buf, no vma [ 445.696472] binder: 22582:22583 transaction failed 29189/-3, size 0-0 line 2967 03:37:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x2000000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x36]}, 0x3) [ 445.721885] binder: 22572:22579 unknown command 0 [ 445.737351] binder: 22572:22579 ioctl c0306201 2000efd0 returned -22 03:37:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) [ 445.785586] binder: undelivered TRANSACTION_ERROR: 29189 [ 445.792698] binder: 22582:22583 got transaction to invalid handle [ 445.799071] binder: 22582:22583 transaction failed 29201/-22, size 0-0 line 2852 [ 445.840914] binder: 22596:22600 ioctl c0306201 2000efd0 returned -11 03:37:53 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4800, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x400000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x0, 0x36]}, 0x5) 03:37:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB="ffffff7f"]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0xa00, 0x8) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = dup3(r1, r0, 0x0) ioctl$KVM_GET_REGS(r3, 0x8090ae81, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) accept$inet6(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c) 03:37:53 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x200, 0x0) ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f0000000380)) mkdir(&(0x7f0000000200)='./file0\x00', 0xfffffffffffffffe) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x3f00000000000000) [ 447.770176] binder: 22616:22619 ioctl c0306201 2000efd0 returned -11 03:37:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(0xffffffffffffffff, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0xe13, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:53 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x2, &(0x7f0000000080)=0x20, 0x4) 03:37:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f]}, 0x3) [ 447.936664] binder: 22629:22632 ioctl c0306201 2000efd0 returned -11 [ 447.965879] binder: BINDER_SET_CONTEXT_MGR already set 03:37:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000040)={[0x3a, 0x34, 0x2f, 0x0]}, 0x5) [ 448.002557] binder: BINDER_SET_CONTEXT_MGR already set [ 448.012453] binder: 22621:22633 ioctl 40046207 0 returned -16 [ 448.035246] binder: 22636:22640 ioctl 40046207 0 returned -16 03:37:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4c, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 448.047800] binder: 22621:22633 unknown command 2147483647 [ 448.055916] binder: 22621:22633 ioctl c0306201 204edfd0 returned -22 [ 448.068699] binder: 22636:22640 ERROR: BC_REGISTER_LOOPER called without request [ 448.092977] binder: 22621:22633 transaction failed 29189/-22, size 0-0 line 2852 [ 448.108603] binder: 22636:22640 unknown command 0 [ 448.128732] binder: undelivered TRANSACTION_ERROR: 29189 [ 448.134848] binder: 22621:22633 ioctl 8090ae81 20000200 returned -22 [ 448.143208] binder: 22636:22640 ioctl c0306201 2000efd0 returned -22 [ 448.150658] binder: 22651:22652 ioctl c0306201 2000efd0 returned -11 [ 448.870334] binder: 22621:22662 unknown command 2147483647 [ 448.876076] binder: 22621:22662 ioctl c0306201 204edfd0 returned -22 [ 448.886551] binder_alloc: 22621: binder_alloc_buf, no vma [ 448.892188] binder: 22621:22661 transaction failed 29189/-3, size 0-0 line 2967 [ 448.896013] binder: 22621:22662 ioctl 8090ae81 20000200 returned -22 [ 448.900802] binder: undelivered TRANSACTION_ERROR: 29189 03:37:54 executing program 6: socket$inet6(0xa, 0x1, 0x0) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:54 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x3, &(0x7f0000000080)=0x20, 0x4) 03:37:54 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x4000000000000000) 03:37:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6000000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a00000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:54 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) socketpair(0x5, 0x800, 0x7, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$TIOCLINUX5(r2, 0x541c, &(0x7f00000003c0)={0x5, 0x0, 0x7, 0x30c, 0xc9}) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) r3 = socket$kcm(0x29, 0x7, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/autofs\x00', 0x0, 0x0) r5 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x7ff, 0x2) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000380)={r1, r5}) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000480)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pread64(r0, &(0x7f0000000200)=""/224, 0xe0, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x88d00, 0x0) getdents(r2, &(0x7f0000000300)=""/174, 0xae) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 448.981708] binder: 22668:22671 ERROR: BC_REGISTER_LOOPER called without request [ 448.983736] binder: BINDER_SET_CONTEXT_MGR already set [ 449.008376] binder: BINDER_SET_CONTEXT_MGR already set [ 449.024010] binder: 22669:22678 ioctl 40046207 0 returned -16 03:37:54 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:54 executing program 6: socket$inet6(0xa, 0x1, 0x0) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:54 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x4, &(0x7f0000000080)=0x20, 0x4) [ 449.026092] binder: 22679:22680 ioctl 40046207 0 returned -16 [ 449.034275] binder: 22668:22671 unknown command 0 [ 449.048258] binder: 22668:22671 ioctl c0306201 2000efd0 returned -22 [ 449.052437] binder: 22669:22678 ioctl c0306201 2000efd0 returned -11 [ 449.057368] binder: 22679:22680 ERROR: BC_REGISTER_LOOPER called without request [ 449.070761] binder_alloc: 22668: binder_alloc_buf failed to map pages in userspace, no vma 03:37:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x2000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 449.079327] binder: 22679:22680 transaction failed 29189/-3, size 0-0 line 2967 [ 449.088904] binder: undelivered TRANSACTION_ERROR: 29189 03:37:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x1000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 449.124866] binder: BINDER_SET_CONTEXT_MGR already set 03:37:54 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:54 executing program 6: socket$inet6(0xa, 0x1, 0x0) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:54 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x20000084) [ 449.172284] binder: 22691:22692 ioctl 40046207 0 returned -16 [ 449.207801] binder: 22691:22692 ioctl c0306201 2000efd0 returned -11 [ 449.217757] binder: 22697:22698 ERROR: BC_REGISTER_LOOPER called without request [ 449.259988] binder: 22697:22698 unknown command 0 [ 449.269499] binder: 22697:22698 ioctl c0306201 2000efd0 returned -22 [ 452.487240] binder: 22727:22730 ioctl c0306201 2000efd0 returned -11 [ 452.494576] binder: BINDER_SET_CONTEXT_MGR already set [ 452.508072] binder: 22724:22729 ioctl 40046207 0 returned -16 03:37:58 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x68000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:58 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:58 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = memfd_create(&(0x7f0000000480)='net/icmp6\x00', 0x52d24d0bad240344) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r1, 0x118, 0x1, &(0x7f00000004c0)=0x2, 0x4) r2 = syz_open_dev$dmmidi(&(0x7f0000000440)='/dev/dmmidi#\x00', 0x4, 0x0) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000140)=""/149) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000200)=""/200) getsockname(r0, &(0x7f0000000380)=@pppoe={0x0, 0x0, {0x0, @link_local}}, &(0x7f0000000040)=0x80) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socketpair(0x0, 0x0, 0xffffffff80000001, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = gettid() r6 = syz_open_procfs(r5, &(0x7f0000000300)='net/icmp6\x00') r7 = syz_genetlink_get_family_id$team(&(0x7f0000000540)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={[], [], @local}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000680)=0xe8) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f00000006c0)={0x0, @local, @rand_addr}, &(0x7f0000000700)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000008c0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f00000009c0)=0xe8) accept4(r0, &(0x7f0000000a00)=@hci={0x0, 0x0}, &(0x7f0000000a80)=0x80, 0x800) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000001000)={0x0, @empty, @remote}, &(0x7f0000001040)=0xc) getpeername$packet(r2, &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000010c0)=0x14) accept$packet(r6, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000025c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000002600)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002640)={'team0\x00', 0x0}) recvmmsg(r6, &(0x7f0000004580)=[{{&(0x7f00000026c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000003c00)=[{&(0x7f0000002740)=""/179, 0xb3}, {&(0x7f0000002800)=""/6, 0x6}, {&(0x7f0000002840)=""/217, 0xd9}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)=""/146, 0x92}, {&(0x7f0000003ac0)=""/57, 0x39}, {&(0x7f0000003b00)=""/223, 0xdf}], 0x8, &(0x7f0000003c80)=""/180, 0xb4}, 0x81}, {{&(0x7f0000003d40)=@in={0x0, 0x0, @multicast1}, 0x80, &(0x7f0000004080)=[{&(0x7f0000003dc0)=""/161, 0xa1}, {&(0x7f0000003e80)=""/131, 0x83}, {&(0x7f0000003f40)=""/125, 0x7d}, {&(0x7f0000003fc0)=""/187, 0xbb}], 0x4, &(0x7f00000040c0)=""/16, 0x10, 0x5}, 0x7}, {{&(0x7f0000004100)=@generic, 0x80, &(0x7f0000004240)=[{&(0x7f0000004180)=""/82, 0x52}, {&(0x7f0000004200)=""/26, 0x1a}], 0x2, &(0x7f0000004280)=""/236, 0xec, 0x8}}, {{0x0, 0x0, &(0x7f0000004480)=[{&(0x7f0000004380)=""/196, 0xc4}], 0x1, &(0x7f00000044c0)=""/140, 0x8c, 0x9}, 0x2c33}], 0x4, 0x40000042, &(0x7f0000004680)) sendmsg$TEAM_CMD_NOOP(r6, &(0x7f0000004b40)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x12000}, 0xc, &(0x7f0000004b00)={&(0x7f00000046c0)={0x440, r7, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r8}, {0x8c, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r9}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r10}}}]}}, {{0x8, 0x1, r11}, {0x12c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xc000}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r13}}, {0x8, 0x7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x100}}}]}}, {{0x8, 0x1, r14}, {0xf0, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4}}, {0x8, 0x6, r15}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x44, 0x4, [{0x8001, 0x8, 0x81, 0x3}, {0x8b, 0x9, 0xc011, 0x80}, {0x101, 0x81, 0x1, 0x3}, {0x0, 0x5, 0x0, 0xff}, {0x3d, 0x6613, 0xffffffffffffffe2, 0x2}, {0x4, 0x59c2, 0x8, 0x3ff}, {0x0, 0x2, 0x3, 0x3}, {0x9, 0xffffffffffffff29, 0x5, 0x8}]}}}]}}, {{0x8, 0x1, r16}, {0x120, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r17}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x34, 0x4, [{0x6, 0xe000000000000000, 0x2, 0x7}, {0xfffffffffffffff7, 0x8, 0x3ff, 0x7}, {0x80000001, 0x7fff, 0x0, 0x80000000}, {0xa2dc, 0x0, 0x800, 0x8}, {0x5, 0x800, 0x5, 0x3f}, {0x0, 0xf0b, 0x2, 0x7fff}]}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x401}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x702}}, {0x8, 0x7}}}]}}]}, 0x440}, 0x1}, 0x801) socket$inet6(0xa, 0x1, 0x0) ioctl(r6, 0x790, &(0x7f0000000500)="e1f50016f477671070") ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000340)=0x1) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6c, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000ec0)='/dev/sequencer2\x00', 0x2, 0x0) getsockname$inet(r2, &(0x7f0000000f00), &(0x7f0000000f40)=0x10) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:58 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) fadvise64(r0, 0x0, 0xa476, 0x7) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x4e, &(0x7f00000007c0)=[{&(0x7f0000000440)=""/70}, {&(0x7f0000000a00)=""/236}, {&(0x7f0000000840)=""/90}, {&(0x7f0000000380)=""/50}, {&(0x7f0000000640)=""/240}, {&(0x7f0000000740)=""/15}, {&(0x7f0000000780)=""/35}], 0x100000000000028c, &(0x7f0000000900)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) r1 = memfd_create(&(0x7f0000000180)='ext3\x00', 0x3) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f00000004c0)=0x37) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000003c0)='ext3\x00', 0x4800, &(0x7f0000000380)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:58 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x40000000) 03:37:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x4c000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 452.538546] binder: 22724:22729 ERROR: BC_REGISTER_LOOPER called without request [ 452.564935] binder: 22724:22729 transaction failed 29189/-22, size 0-0 line 2852 [ 452.605397] binder: 22737:22739 ERROR: BC_REGISTER_LOOPER called without request [ 452.628395] binder: undelivered TRANSACTION_ERROR: 29189 [ 452.642924] binder: BINDER_SET_CONTEXT_MGR already set 03:37:58 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) [ 452.655096] binder: 22740:22741 ioctl 40046207 0 returned -16 [ 452.669402] binder: 22737:22739 unknown command 0 [ 452.682631] binder: 22740:22741 ioctl c0306201 2000efd0 returned -11 [ 452.689575] binder: 22737:22739 ioctl c0306201 2000efd0 returned -22 03:37:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x130e, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x7a, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:58 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:58 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) socket$inet6(0xa, 0x1, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:58 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = dup2(r0, r1) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f00000000c0)={0x9, 0x1}) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 452.860445] binder: 22756:22757 ioctl c0306201 2000efd0 returned -11 [ 452.871366] binder: BINDER_SET_CONTEXT_MGR already set [ 452.913456] binder: 22758:22759 ioctl 40046207 0 returned -16 [ 452.957796] binder: 22758:22759 ERROR: BC_REGISTER_LOOPER called without request [ 453.003216] binder: 22758:22759 unknown command 0 [ 453.015443] binder: 22758:22759 ioctl c0306201 2000efd0 returned -22 03:37:59 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:59 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/net/pfkey\x00', 0x40200, 0x0) accept$alg(r1, 0x0, 0x0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x80) getpeername$netrom(r2, &(0x7f0000000200), &(0x7f0000000240)=0x10) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) pipe(&(0x7f0000000280)={0xffffffffffffffff}) ioctl$KVM_GET_REGS(r4, 0x8090ae81, &(0x7f0000000140)) 03:37:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x120e, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:59 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r1, &(0x7f0000012ff6)='./control\x00') renameat2(r0, &(0x7f0000000000)='./control\x00', r1, &(0x7f0000000040)='./control\x00', 0x2) 03:37:59 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x40002) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) r2 = shmget(0x1, 0x2000, 0x1, &(0x7f0000ffd000/0x2000)=nil) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000740)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000080)=0xe8) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000840)={{{@in6=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6}}, &(0x7f0000000600)=0xe8) stat(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000009c0)=0x0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/snapshot\x00', 0x40440, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000001ec0)={0x9, 0x0, [{0x3000, 0x1b, &(0x7f0000000b00)=""/27}, {0x2, 0x1000, &(0x7f0000000b40)=""/4096}, {0xf000, 0x93, &(0x7f0000001b40)=""/147}, {0x0, 0x12, &(0x7f0000001c00)=""/18}, {0x1000, 0xe4, &(0x7f0000001c40)=""/228}, {0x1, 0x62, &(0x7f0000001d40)=""/98}, {0x0, 0x7, &(0x7f0000001dc0)=""/7}, {0x4, 0x19, &(0x7f0000001e00)=""/25}, {0x10000, 0x77, &(0x7f0000001e40)=""/119}]}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000a00)=0x0) shmctl$IPC_SET(r2, 0x1, &(0x7f0000000a40)={{0x20, r3, r4, r5, r6, 0x1}, 0x6, 0x100000000, 0x5, 0x3, r7, r9, 0x5}) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000100)='bdev\x00', 0xffffd, &(0x7f0000000680)="c2b542c2629348c96c3f8cdea954a9b32d70920d0fc78077b9ac2c05dd2b97e9a481a0c1c0eaf79c8aa92795823b2ef6e8f4c94de72eed7d75464d56b1c2f4ec85de1254e903232a8c8698a6ad5ef5e25455a4d10fe97b56e2c48af2f65692b56da3762a84b486a8b4f3d57435942f31af46b4d693f06fb86c278d80be71f1deb386d0bc0e4641ef74ed41b4f6437323155568e566a484cdd23ffb") mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000005c0)='.', &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000753000)='mslOs\x00', 0x41000, &(0x7f0000000440)="3a2c6c6e9ac68942bc3dad46180008017d1fc9569ddd6ab5b27450085f8e0004000000ce06a33db8594feab32b0ddf2ed1003facd9f4b421e4bd0370cf1016ace9ca816ce923b53acd09a0dae94baa285c883ef712a6a11fb59bcc4775a8123f459d1c617e79f450e28eae5c0466c60f480bd28e9a93f083aa42cf8f844c190ee20351a78b94a74dbb54d317f8b4952667db7b774dd1385916f112f84dec016a3d31f8e4268c0cc271a8ac25fa8d4b9096e209ffcd2dba91dd88c13f3df4ced695f78afa41bf5f5c25178747d34e3893300362503cca6883f83426c24b81943cbda8c61161ec2748dd4259086dc3a7e59cdaebb03dd2f2c4bbbcea69c3f46c80edca5083209b519c72b13862aabf4a0bd385c455b7e6e4ac2590d1785942e5f9830e925aeeb9f8811be309f21d8a1252dc0f3ba7cd259e2610233525e001da195c3bc87a9ae50000000000") socket$vsock_dgram(0x28, 0x2, 0x0) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') 03:37:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4800000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x1000000) 03:37:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101000, 0x0) r3 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x8000, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f00000000c0)=0x5) openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x100, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000200)={0x2, 0x0, [{0x80000000, 0x5, 0xc5ad, 0x85b, 0x4e4}, {0x40000005, 0xe06, 0xde, 0x8001}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 453.627371] binder: BINDER_SET_CONTEXT_MGR already set [ 453.633865] binder: 22775:22779 ERROR: BC_REGISTER_LOOPER called without request [ 453.641550] binder: BINDER_SET_CONTEXT_MGR already set [ 453.653972] binder: 22783:22786 ioctl 40046207 0 returned -16 [ 453.663087] binder: 22778:22788 ioctl 40046207 0 returned -16 03:37:59 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:59 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2004, 0x800, 0x9}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000140)=""/116, &(0x7f00000000c0)=0x74) 03:37:59 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) [ 453.674393] binder: 22775:22779 unknown command 0 [ 453.688925] binder: 22775:22779 ioctl c0306201 2000efd0 returned -22 [ 453.697189] binder: 22783:22786 ERROR: BC_REGISTER_LOOPER called without request [ 453.712371] binder: 22778:22788 ioctl c0306201 2000efd0 returned -11 [ 453.715071] binder_alloc: 22775: binder_alloc_buf failed to map pages in userspace, no vma 03:37:59 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:37:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x68000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 453.727530] binder: 22783:22786 transaction failed 29189/-3, size 0-0 line 2967 [ 453.753351] binder: undelivered TRANSACTION_ERROR: 29189 03:37:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6c, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:37:59 executing program 7: setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x400000890e, &(0x7f0000000180)="295ee1311f16f477671070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0xc000, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:37:59 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) [ 453.842331] binder: 22809:22811 ERROR: BC_REGISTER_LOOPER called without request [ 453.847425] binder: BINDER_SET_CONTEXT_MGR already set [ 453.856427] binder: 22812:22813 ioctl 40046207 0 returned -16 [ 453.866271] binder: 22812:22813 ioctl c0306201 2000efd0 returned -11 03:37:59 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:37:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x7, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 453.888476] binder: 22809:22811 unknown command 0 [ 453.912064] binder: 22809:22811 ioctl c0306201 2000efd0 returned -22 [ 453.972663] binder: BINDER_SET_CONTEXT_MGR already set [ 453.996199] binder: 22824:22828 ioctl 40046207 0 returned -16 [ 454.009284] binder: 22824:22828 ioctl c0306201 2000efd0 returned -11 03:38:00 executing program 7: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8947, 0x2041) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @broadcast}, &(0x7f00000003c0)=0xc) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x8, 0x200) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000140)={{0x2, 0x1, 0xda22, 0x0, 0x8d}, 0x6c, 0x8, 'id1\x00', 'timer0\x00', 0x0, 0x8000, 0xff, 0x47a}) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=0x0, &(0x7f0000000280)=0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f00000002c0)={r4, 0x7e, "1470417ebbcc77760250849c3ebc4fbb90a9f0eb5172b47cb99476d3aa425715a5521b23e7cf86e7c024fd97447190943259a2b1fafec6dc4509d1ca77185479c918a58585872f5a9036395ccaa908ee553511a89c02284782c470e0fe5912f5612e75ba3cebe3b6c3b8beaf5d279c49e642cf25add6f6f3095d05dce46a"}, &(0x7f0000000380)=0x86) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000240)=0x200002, 0x4) 03:38:00 executing program 3: setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:00 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0xea03, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:00 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x7, 0x101) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x200, 0x0) fanotify_mark(r0, 0x4, 0x0, r1, &(0x7f0000000380)='./file0\x00') mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000400)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x28, r3, 0x203, 0x70bd26, 0x25dfdbfe, {0x2}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x3f}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x40000) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000600)='./file0/file0\x00') 03:38:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/rpc\x00') clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) futimesat(r2, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={{r3, r4/1000+30000}, {0x77359400}}) r5 = socket$inet6(0xa, 0x1, 0x0) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000180)=0x2) ioctl(r5, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x3f000000) 03:38:00 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200002, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x58) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000200)=0x800, 0x0) 03:38:00 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) [ 454.772820] binder: BINDER_SET_CONTEXT_MGR already set [ 454.780806] binder: 22847:22849 ERROR: BC_REGISTER_LOOPER called without request [ 454.780869] binder: BINDER_SET_CONTEXT_MGR already set [ 454.798601] binder: 22853:22854 ioctl 40046207 0 returned -16 [ 454.803846] binder: 22848:22855 ioctl 40046207 0 returned -16 [ 454.812726] binder: 22847:22849 unknown command 0 [ 454.822607] binder: 22847:22849 ioctl c0306201 2000efd0 returned -22 [ 454.831806] binder: 22853:22854 ioctl c0306201 2000efd0 returned -11 03:38:00 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:00 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = memfd_create(&(0x7f00000000c0)='user\x00', 0x2) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000180)) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000140)={0x5, 0x5, 0xe81, 0x0, 0x7f4}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 454.870921] binder: 22848:22855 ERROR: BC_REGISTER_LOOPER called without request 03:38:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x700, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:00 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x0, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x4c, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 454.911835] binder_alloc: 22847: binder_alloc_buf failed to map pages in userspace, no vma [ 454.920531] binder: 22848:22855 transaction failed 29189/-3, size 0-0 line 2967 [ 454.931516] binder: undelivered TRANSACTION_ERROR: 29189 [ 454.984424] binder: 22875:22877 ioctl c0306201 2000efd0 returned -11 [ 455.046421] binder: 22880:22883 ERROR: BC_REGISTER_LOOPER called without request [ 455.072669] binder: 22880:22883 unknown command 0 [ 455.077723] binder: 22880:22883 ioctl c0306201 2000efd0 returned -22 03:38:01 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:01 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:38:01 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="12634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x40000, 0x0) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x6000000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:01 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x2000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000100)={'bpq0\x00', {0x2, 0x4e24, @loopback=0x7f000001}}) recvmmsg(r0, &(0x7f0000002440), 0x400000000000142, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2) 03:38:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x300, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x3f00) [ 456.053250] binder: 22901:22903 ioctl c0306201 2000efd0 returned -11 [ 456.059497] binder: BINDER_SET_CONTEXT_MGR already set [ 456.065801] binder: BINDER_SET_CONTEXT_MGR already set [ 456.085733] binder: 22906:22909 ioctl 40046207 0 returned -16 [ 456.088190] binder: 22902:22908 ioctl 40046207 0 returned -16 03:38:01 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x3, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:01 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:01 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x101000, 0x0) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f0000000140)={0x1, 0x2, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}]}) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 456.110494] binder: 22906:22909 ERROR: BC_REGISTER_LOOPER called without request [ 456.126617] binder: 22906:22909 unknown command 0 [ 456.132662] binder: 22906:22909 ioctl c0306201 2000efd0 returned -22 [ 456.154433] binder: 22902:22908 ERROR: BC_REGISTER_LOOPER called without request 03:38:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x300000000000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 456.193437] binder: 22915:22919 ioctl c0306201 2000efd0 returned -11 [ 456.204836] binder: 22902:22908 got reply transaction with no transaction stack [ 456.212437] binder: 22902:22908 transaction failed 29201/-71, size 0-0 line 2759 03:38:01 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) [ 456.251830] binder: BINDER_SET_CONTEXT_MGR already set 03:38:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:01 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:01 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000380)="295ee17d22edf4c0132c2ce22ce20442236426408ad4fcdf6f3c9c207fccdb063a1ae038bcf7c6d044d0000000000000000000000000000000002eda48ed9d992f7d544a70b2762aa8255449b790220b110b7ba5995d6b2967a0b194c40b6a185b095b49f1f52e75a53f69f8181347e658b815385619f241853f00000000000000004effe13daa7a51dc627c5f77a475fc8ba50b2e6bb0e9d018ad083eb140cf94a3e7be760bbc13bfad9fd91c8a9a8cbac6a4b6340ae7aa81bbbaa6bff8dffba1ce60fff9b5c1cf") sendfile(r0, r0, &(0x7f00000000c0), 0xb9d0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 456.272121] binder: undelivered TRANSACTION_ERROR: 29201 [ 456.285207] binder: 22928:22929 ioctl 40046207 0 returned -16 [ 456.309909] binder: 22928:22929 ERROR: BC_REGISTER_LOOPER called without request [ 456.338874] binder: 22938:22939 ioctl c0306201 2000efd0 returned -11 [ 456.368171] binder: 22928:22929 unknown command 0 [ 456.377914] binder: 22928:22929 ioctl c0306201 2000efd0 returned -22 03:38:02 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:02 executing program 7: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f00000000c0)={0xffffffffffffff9c}) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000140)={0x0, 0x2}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={r1, 0x0, &(0x7f00000001c0)}, &(0x7f0000000240)=0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:38:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x400000000000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x2000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FICLONE(r1, 0x40049409, r0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="11636b9448dbe9e49431d678a2ed0748e3", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x2000000000000003, 0x1) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x3e, "9be142eaa7a3c424cfbda9c61d44b215761a51cc44b3bf312ea70aead86a5b075caf4f342338b13c5df2e6bbd005c981939669994dbc9c8fa7bd104f7e9d"}, &(0x7f00000000c0)=0x46) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000200)={r4, @in6={{0xa, 0x4e21, 0x80, @loopback={0x0, 0x1}, 0xfff}}}, 0x84) 03:38:02 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:02 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) r1 = syz_open_dev$dspn(&(0x7f00000003c0)='/dev/dsp#\x00', 0x80, 0x80) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f00000006c0)={0x6000000000000000, 0x100000, 0xffff, 0x9, 0x3}) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file0\x00') syz_mount_image$hfs(&(0x7f0000000100)='hfs\x00', &(0x7f0000000200)='./file0/file0\x00', 0x81, 0x3, &(0x7f00000005c0)=[{&(0x7f0000000440)="4ccba5c2e1a3eac2ead0f0a1428f745119f1c51ce05278876b68cea272a30c06e2eaec044893d0618246b892d0d0fd10ae620708efb17c0669fce622edd829e7bcf0fb4c777b4c5afcf84b209388c2a2e194557d6a61e43200c2bfaec0b4449ec211792e6a4a5c8052ea3fef4381e337e6f89e384d8ed0c06a1f6cd719c2ce66bf39b3e658bb827fe8", 0x89, 0x8}, {&(0x7f0000000500)="0f37c0db4ae1bf44e2d49b46f4413a67ae77bf6d8a692a79cff46cacd92694184a6d303da3f2717adfda394bef0e7a30debb7fea9a5a6abf1994204092960c5c0e699ea21bb1e121160668cf54639c7fcd7c2803a7b3ba708fcce40e659793e6c9a3457aff238c802028837fa514de15f80c5102711cd906cf7dd7500abb60989cb39095dee57b5378f87550216e1ff63e23a6dfb622626fb67888", 0x9b, 0xffffffffffffffff}, {&(0x7f0000000380)="68722e39959aeeb73b0e8ed981b78678e97eb366b016f68197af577609f0729449abdbeb", 0x24, 0x1}], 0x1409, &(0x7f0000000640)={[{@uid={'uid', 0x3d, [0x38, 0x2d]}, 0x2c}, {@uid={'uid', 0x3d, [0x3f, 0x35, 0x37, 0x3f, 0x0]}, 0x2c}, {@iocharset={'iocharset', 0x3d, 'maccroatian'}, 0x2c}, {@creator={'creator', 0x3d, "8823249e"}, 0x2c}, {@session={'session', 0x3d, [0x31, 0x7f]}, 0x2c}, {@dir_umask={'dir_umask', 0x3d, [0x30]}, 0x2c}, {@file_umask={'file_umask', 0x3d, [0x32, 0x34, 0x37, 0x34]}, 0x2c}, {@codepage={'codepage', 0x3d, 'iso8859-14'}, 0x2c}]}) 03:38:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x4000) [ 457.434707] binder: 22962:22963 ERROR: BC_REGISTER_LOOPER called without request [ 457.443461] binder: BINDER_SET_CONTEXT_MGR already set [ 457.450053] binder: BINDER_SET_CONTEXT_MGR already set [ 457.455585] binder: 22965:22969 ioctl 40046207 0 returned -16 [ 457.462359] binder: 22968:22970 ioctl 40046207 0 returned -16 [ 457.477254] binder: 22962:22963 unknown command -1804901615 03:38:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:03 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:03 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000000c0)=0x1000000001f, 0x2) 03:38:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x6c000000, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 457.483516] binder: 22965:22969 ioctl c0306201 2000efd0 returned -11 [ 457.499243] binder: 22968:22970 ERROR: BC_REGISTER_LOOPER called without request [ 457.508764] binder: 22962:22963 ioctl c0306201 20007000 returned -22 [ 457.524181] binder: 22968:22970 unknown command 0 03:38:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) [ 457.572155] binder: 22968:22970 ioctl c0306201 2000efd0 returned -22 [ 457.603126] binder: BINDER_SET_CONTEXT_MGR already set 03:38:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0xfeffffff, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:03 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:03 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$minix(&(0x7f0000000100)='minix\x00', &(0x7f00000001c0)='./file0\x00', 0xd91, 0x0, &(0x7f00000004c0), 0x1010, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) [ 457.620924] binder: 22990:22991 ioctl 40046207 0 returned -16 [ 457.628982] binder: 22990:22991 ioctl c0306201 2000efd0 returned -11 [ 457.681114] binder: BINDER_SET_CONTEXT_MGR already set [ 457.716153] binder: 22997:22999 ioctl 40046207 0 returned -16 [ 457.740764] binder: 22997:22999 ERROR: BC_REGISTER_LOOPER called without request [ 457.760659] binder: 22997:22999 unknown command 0 [ 457.766482] binder: 22997:22999 ioctl c0306201 2000efd0 returned -22 03:38:05 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x2000000000005, 0x0, &(0x7f0000000ac0)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000002200)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002300), 0x0, &(0x7f0000002340)=""/200, 0xc8}}], 0x1, 0x0, &(0x7f0000002540)) unshare(0x28020400) mount(&(0x7f0000000540)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x8, &(0x7f0000000440)="f2ff6c053c22a897c0b3032ec7c41806923d3e390b8c7ed67abbaf7e96b758a74a935dc0e2a41d2b202f490b9cc26aece3cadba4d9dde51343e626fc0b0cf31f145a88aaa63a8ec021ff1dce66ef4aa424e5f876747b85ee3b3b1ad444b32672a1f8d601391483303dceabd620cbd46d4318bc7b366ef12034a96e4df8db5265cee86ea161e8071c594d0584e588172dbc47fad48bd716aa6e2f161429fb51538ac50596a822dd81add70e80f355328047e60519820cb3ce0ca3c665f6786705bbb03949c3c4f8611c") mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x81, 0x4200) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000380)={&(0x7f0000000200)=""/2, 0x206000, 0x0, 0x8}, 0x18) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) syz_mount_image$nfs4(&(0x7f00000003c0)='nfs4\x00', &(0x7f0000000580)='./file0/file1\x00', 0x5, 0x5, &(0x7f0000000a00)=[{&(0x7f00000005c0)="1f5a5cb6f4d3ed1f9a4830ccfef36348013f7459fe506f7758fbaf673e8a53388325b0a346ced318f108d24e733000a004d64ee66d393c7705078ce299b75c2d7d0d25e307324ed313727f01fb22358ae48eaba68c44075e0deba576a396cd25dcf83b16b92f", 0x66, 0x2}, {&(0x7f0000000640)="c9308e9d77b0a0de9cbe9bccecac46107ac8fb9d01a7bb5efbed51cc795055ff7821aa711adefe8b7286ba7e65039c3e409107f760c44035376efede2db956cbf6533ab3d9fa68953681aeb7f42cab6ac449199f1cf9882b49ee09c145c00a511aac5d36780e687bbedad4c10f5ddb473408cefbf23c5917b3d0602426f9a5ba7487db969dffa9815d4487c44c4256a4a6088037d92dd3fddafc365761cce1976a5b0c6653909d66c214a47405d7685727a2cbbb6eb5afd638620062e437bf5efc9178631917a258a63a94462848", 0xce, 0x3}, {&(0x7f0000000740)="d8665eb9b1d315b544287963689a4022a26a5eb35627a80a83be48efe59e0e96e94680aa1292802907a5ac587ad15e913de28b7954f33b30d136af117d47c646f61ffb333c5ca040e918cd75598565bd07ed8b853aa0c72eb18c933c25742cb66439f359141d2df40de6259c5c0ff7f64204e9262daee37a631cf591e5ca97f2d94c9b616c38bac23a246979169b6ae4748a3ca1e8c42578b365f4b3c068a43989dedd51ea603cbcc82cb6284db9ed561220f8a011875c383ad067d5d089b1d7e7f08a6f86f3eca9a2", 0xc9, 0x2}, {&(0x7f0000000900)="d56a5a74b903f37e430a30d8845dd05284ce584c4ea00bd8696d67f463b7ce35b28dc548dcb702600bc11130182ed178fc7f56b9889e4d490b995ab61343fe9ff52f8f94634b7fe0a5e982dab71ffc00607cff20538644464353b48a47e248e70fd55ea07efb8209d925b60ceae3ce0ae1b6ed85d247280b2c38a38422427ee8cb1c4505696d79d3a64776fb662db5b2e3cb2dd193b78873daa1318e8f5e5aff11450fdf7f9d1b7b3ae0b35dc8322935d3ef7d1aa255d10042aebaeabec274680ea3792b371f0704a66f8134e44211386b8c2fe9378e3a919ec809656dd56ad9be1888694fd7a4dfa1c0656bf7b955b04d1b5355300f0f6589f190", 0xfb, 0x3ff}, {&(0x7f0000000840)="86c1f135abe0d64d38b477ccc618cff386bda80cb5c4041482f230bb07cb9337d40b2874cde7c648ae286b86c927efe6ddfbad1726860466cba4a00a6815fb29d716cc2511964ef0ff5c1cc436792202", 0x50, 0x3}], 0x0, &(0x7f0000000a80)='/dev/vcs#\x00') mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000002c0)) mount(&(0x7f00008deff8)='/\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)="6e66730039ad695ab91f0928267795ce2b07ba848ecc6b7c69", 0x2007a00, &(0x7f0000000140)) rmdir(&(0x7f0000000400)='./file1\x00') 03:38:05 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x0, 0x60, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:05 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) r2 = socket$inet6(0xa, 0x80002, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:05 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x7fffffff, 0x200080) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$TUNSETOWNER(r2, 0x400454cc, r3) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) 03:38:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r1, 0x100000000000000) 03:38:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper={0x630b}]}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000efd0)={0x40000000, 0x0, &(0x7f0000000000), 0x1, 0xfdfd, &(0x7f00000001c0)="ef"}) 03:38:05 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:05 executing program 7: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x8001, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000140)) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) 03:38:05 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) [ 459.634791] binder: 23028:23039 ERROR: BC_REGISTER_LOOPER called without request [ 459.673727] binder: release 23028:23039 transaction 414 out, still active [ 459.680848] binder: undelivered TRANSACTION_COMPLETE [ 459.686888] binder: send failed reply for transaction 414, target dead [ 459.721100] binder: 23028:23039 ioctl c0306201 2000efd0 returned -14 03:38:05 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = dup(r0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {0xe}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000000000000}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8f}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1f}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4000000) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000000c0)=0x10000, 0x5d) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000080)=0x88) 03:38:05 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x20, 0x4) 03:38:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00004edfd0)={0x4, 0x0, &(0x7f0000003fe8)=ANY=[@ANYBLOB='\x00\x00\x00\x00']}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f00004ee64e)}) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) r3 = gettid() ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000200)={0x1, 0x8}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x2, 0x20000) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x2d, 'cpu', 0x20}, {0x2f, 'cpu', 0x20}, {0x2d, 'pids', 0x20}]}, 0x10) kcmp(r2, r3, 0x4, r1, r0) r5 = socket$inet6(0xa, 0x1, 0x0) ioctl(r5, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r6 = dup3(r1, r0, 0x0) write(r4, &(0x7f0000000140)="be3f0cb545559d2e2e7f20d4e4b4bd16e252a029ccb610cd3f379a031443b1f13793319e095e1fee6f5d3afc3cb11db48e7cdd7259980deea7d94fd37d1724d1efe924320a71", 0x46) r7 = mmap$binder(&(0x7f0000010000/0x2000)=nil, 0x2000, 0xe, 0x10, r6, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000efd0)={0xffffffffffffff55, 0x0, &(0x7f0000000380)=[@increfs={0x40046304, 0x2}, @increfs_done={0x40106308, r7}, @request_death={0x400c630e, 0x2, 0x4}, @reply={0x40406301, {0x3, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000280)=[0x40, 0x28, 0x0]}}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@ptr={0x70742a85, 0x0, &(0x7f00000002c0), 0x0, 0x4, 0x2a}, @fd={0x66642a85, 0x0, r6, 0x0, 0x4}], &(0x7f0000000340)=[0x38]}, 0x1}}], 0x0, 0xfdfd, &(0x7f00000001c0)="ef"}) [ 459.901728] binder: 23051:23053 unknown command 0 [ 459.929095] binder: BINDER_SET_CONTEXT_MGR already set 03:38:05 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000016ff8)='./file0\x00', 0x0) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r1, &(0x7f0000000000)='./control\x00', r2, &(0x7f0000000040)='./control\x00', 0x2) 03:38:05 executing program 7: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x2000, 0x800}, 0x18) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x8, &(0x7f0000000180)="295ee1311f16f477671070") r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x101000, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000140)={0x3ff}, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) close(r0) [ 459.949729] binder: BINDER_SET_CONTEXT_MGR already set [ 459.955130] binder: 23046:23056 ioctl 40046207 0 returned -16 [ 459.960214] binder: 23051:23053 ioctl c0306201 204edfd0 returned -22 [ 459.964754] binder: 23034:23055 ioctl 40046207 0 returned -16 [ 459.977417] binder: 23046:23056 ioctl c0306201 2000efd0 returned -11 [ 459.985473] binder: 23034:23055 ERROR: BC_REGISTER_LOOPER called without request [ 459.999286] binder: 23034:23055 unknown command 0 [ 460.009971] binder: 23034:23055 ioctl c0306201 2000efd0 returned -22 [ 460.010009] binder: 23051:23053 ioctl 4010640d 20000200 returned -22 [ 460.056481] ================================================================== [ 460.064155] BUG: KASAN: null-ptr-deref in xdp_umem_unaccount_pages.isra.4+0x3d/0x80 [ 460.071969] Write of size 8 at addr 0000000000000060 by task kworker/0:1/26 [ 460.079071] [ 460.079685] binder: release 23051:23053 transaction 416 out, still active [ 460.080704] CPU: 0 PID: 26 Comm: kworker/0:1 Not tainted 4.17.0+ #91 [ 460.080718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 460.080739] Workqueue: events xdp_umem_release_deferred [ 460.080748] Call Trace: [ 460.080767] dump_stack+0x1b9/0x294 [ 460.087704] binder: undelivered TRANSACTION_COMPLETE [ 460.094155] ? dump_stack_print_info.cold.2+0x52/0x52 [ 460.094171] ? kasan_check_write+0x14/0x20 [ 460.094185] ? do_raw_spin_lock+0xc1/0x200 [ 460.094197] ? vprintk_func+0x81/0xe7 [ 460.094209] ? xdp_umem_unaccount_pages.isra.4+0x3d/0x80 [ 460.094227] kasan_report.cold.7+0x6d/0x2fe [ 460.124888] binder: send failed reply for transaction 416, target dead [ 460.125382] check_memory_region+0x13e/0x1b0 [ 460.125398] kasan_check_write+0x14/0x20 [ 460.125414] xdp_umem_unaccount_pages.isra.4+0x3d/0x80 [ 460.125431] xdp_umem_release_deferred+0x46a/0x600 [ 460.172616] ? xdp_umem_unaccount_pages.isra.4+0x80/0x80 [ 460.178059] process_one_work+0xc64/0x1b70 [ 460.182282] ? finish_task_switch+0x182/0x840 [ 460.186770] ? pwq_dec_nr_in_flight+0x490/0x490 [ 460.191431] ? __schedule+0x809/0x1e30 [ 460.195309] ? lock_downgrade+0x8e0/0x8e0 [ 460.199456] ? graph_lock+0x170/0x170 [ 460.203246] ? graph_lock+0x170/0x170 [ 460.207042] ? find_held_lock+0x36/0x1c0 [ 460.211093] ? find_held_lock+0x36/0x1c0 [ 460.215154] ? lock_acquire+0x1dc/0x520 [ 460.219124] ? worker_thread+0x3d4/0x13a0 [ 460.223257] ? lock_downgrade+0x8e0/0x8e0 [ 460.227390] ? lock_release+0xa10/0xa10 [ 460.231353] ? kasan_check_read+0x11/0x20 [ 460.235496] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 460.240071] worker_thread+0x181/0x13a0 [ 460.244041] ? process_one_work+0x1b70/0x1b70 [ 460.248528] ? graph_lock+0x170/0x170 [ 460.252318] ? find_held_lock+0x36/0x1c0 [ 460.256371] ? find_held_lock+0x36/0x1c0 [ 460.260427] ? __schedule+0x1e30/0x1e30 [ 460.264391] ? do_raw_spin_unlock+0x9e/0x2e0 [ 460.268784] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 460.273366] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 460.278899] ? __kthread_parkme+0x111/0x1d0 [ 460.283205] ? parse_args.cold.15+0x1b3/0x1b3 [ 460.287688] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 460.292695] ? trace_hardirqs_on+0xd/0x10 [ 460.296845] kthread+0x345/0x410 [ 460.300201] ? process_one_work+0x1b70/0x1b70 [ 460.304685] ? kthread_bind+0x40/0x40 [ 460.308475] ret_from_fork+0x3a/0x50 [ 460.312179] ================================================================== [ 460.319533] Disabling lock debugging due to kernel taint [ 460.325100] Kernel panic - not syncing: panic_on_warn set ... [ 460.325100] [ 460.332479] CPU: 0 PID: 26 Comm: kworker/0:1 Tainted: G B 4.17.0+ #91 [ 460.340366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 460.349725] Workqueue: events xdp_umem_release_deferred [ 460.355075] Call Trace: [ 460.357652] dump_stack+0x1b9/0x294 [ 460.361285] ? dump_stack_print_info.cold.2+0x52/0x52 [ 460.366463] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 460.371209] ? xdp_umem_unpin_pages.isra.3+0x350/0x410 [ 460.376470] panic+0x22f/0x4de [ 460.379665] ? add_taint.cold.5+0x16/0x16 [ 460.383825] ? do_raw_spin_unlock+0x9e/0x2e0 [ 460.388217] ? do_raw_spin_unlock+0x9e/0x2e0 [ 460.392613] ? xdp_umem_unaccount_pages.isra.4+0x3d/0x80 [ 460.398047] kasan_end_report+0x47/0x4f [ 460.402005] kasan_report.cold.7+0x76/0x2fe [ 460.406312] check_memory_region+0x13e/0x1b0 [ 460.410701] kasan_check_write+0x14/0x20 [ 460.414757] xdp_umem_unaccount_pages.isra.4+0x3d/0x80 [ 460.420021] xdp_umem_release_deferred+0x46a/0x600 [ 460.424935] ? xdp_umem_unaccount_pages.isra.4+0x80/0x80 [ 460.430379] process_one_work+0xc64/0x1b70 [ 460.434593] ? finish_task_switch+0x182/0x840 [ 460.439073] ? pwq_dec_nr_in_flight+0x490/0x490 [ 460.443726] ? __schedule+0x809/0x1e30 [ 460.447611] ? lock_downgrade+0x8e0/0x8e0 [ 460.451766] ? graph_lock+0x170/0x170 [ 460.455569] ? graph_lock+0x170/0x170 [ 460.459356] ? find_held_lock+0x36/0x1c0 [ 460.463404] ? find_held_lock+0x36/0x1c0 [ 460.467449] ? lock_acquire+0x1dc/0x520 [ 460.471412] ? worker_thread+0x3d4/0x13a0 [ 460.475544] ? lock_downgrade+0x8e0/0x8e0 [ 460.479677] ? lock_release+0xa10/0xa10 [ 460.483634] ? kasan_check_read+0x11/0x20 [ 460.487768] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 460.492339] worker_thread+0x181/0x13a0 [ 460.496304] ? process_one_work+0x1b70/0x1b70 [ 460.500801] ? graph_lock+0x170/0x170 [ 460.504585] ? find_held_lock+0x36/0x1c0 [ 460.508635] ? find_held_lock+0x36/0x1c0 [ 460.512687] ? __schedule+0x1e30/0x1e30 [ 460.516642] ? do_raw_spin_unlock+0x9e/0x2e0 [ 460.521032] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 460.525598] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 460.531118] ? __kthread_parkme+0x111/0x1d0 [ 460.535441] ? parse_args.cold.15+0x1b3/0x1b3 [ 460.539927] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 460.544928] ? trace_hardirqs_on+0xd/0x10 [ 460.549071] kthread+0x345/0x410 [ 460.552434] ? process_one_work+0x1b70/0x1b70 [ 460.556914] ? kthread_bind+0x40/0x40 [ 460.560701] ret_from_fork+0x3a/0x50 [ 460.564952] Dumping ftrace buffer: [ 460.568481] (ftrace buffer empty) [ 460.572184] Kernel Offset: disabled [ 460.575792] Rebooting in 86400 seconds..