0x2405, r3) r4 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, &(0x7f0000000080)=0x6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:48:42 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000040)="5ea857a27df0c960a2eba760a7e132705464b0f4468c17fa01283912b7af0d5cf0e592325a4be11d66f1bed5201a671dc052e5faba28f7c730dbf230395d4a", 0x3f) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote, @in=@broadcast}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f0000000000)=0xe8) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="778bfca065d8dbb0ffff0000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:48:42 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f00000001c0)={'raw\x00'}, &(0x7f0000000240)=0x54) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x5000) write$P9_RATTACH(r3, &(0x7f00000002c0)={0x14, 0x69, 0x1, {0x40, 0x1, 0x7}}, 0x14) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000000340)={0x0, 0x0}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x204c00, 0x10) ioctl$TIOCMGET(r8, 0x5415, &(0x7f00000003c0)) accept$packet(r6, 0x0, &(0x7f0000000000)) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000100)=r7) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x1) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@initdev, @in6=@local}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f00000000c0)=0xe8) readahead(r2, 0x2, 0x10000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a6273000000000000000000000000000000000000852a6466000000000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1445.685719] binder: 1509:1512 got transaction with fd, -1, but target does not allow fds [ 1445.686082] binder_alloc: 1503: binder_alloc_buf, no vma 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1445.686100] binder: 1503:1510 transaction failed 29189/-3, size 72-24 line 3284 [ 1445.686322] binder: undelivered TRANSACTION_ERROR: 29189 [ 1445.688031] binder: 1508:1511 got transaction with invalid offset (0, min 0 max 0) or object. [ 1445.688056] binder: 1508:1511 transaction failed 29201/-22, size 0-24 line 3379 23:48:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000000000000000000000003a899ed37dfeee96ab9838c7e9c539e5c958d642402c944eb3f1e4088a27b3d223d9c6545f13339592fcbe00b17c552901a9095a34cb3521301690d7bd7b3c1bf43b0cecad1cb6236cb172593188496258dc30204c130f471dd648d49aa4e7bba10978dc8a38665355d67b4b41937d13f4c973c84a99db5c2c058a9017fa180550ebef4952f1755d92f9fe8c5e761e8bbd878acc764c"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat(r3, &(0x7f0000000000)='./file0\x00', 0x400000, 0x3b) getsockopt$inet_mreqsrc(r4, 0x0, 0x28, &(0x7f0000000040)={@empty, @multicast2, @loopback}, &(0x7f0000000080)=0xc) [ 1445.688284] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.693841] binder_alloc: 1503: binder_alloc_buf, no vma [ 1445.693856] binder: 1503:1516 transaction failed 29189/-3, size 72-24 line 3284 [ 1445.694091] binder: undelivered TRANSACTION_ERROR: 29189 [ 1445.714141] binder: 1517:1519 got transaction with invalid offset (0, min 0 max 0) or object. [ 1445.714167] binder: 1517:1519 transaction failed 29201/-22, size 0-24 line 3379 [ 1445.714388] binder: undelivered TRANSACTION_ERROR: 29201 23:48:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1445.738363] binder: 1520:1525 got transaction with invalid offset (24, min 24 max 72) or object. [ 1445.738398] binder: 1520:1525 transaction failed 29201/-22, size 72-24 line 3379 [ 1445.738789] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.740203] binder: 1524:1526 not enough space to store 0 fds in buffer [ 1445.740228] binder: 1524:1526 transaction failed 29201/-22, size 112-24 line 3475 [ 1445.740436] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.764846] binder: 1528:1530 not enough space to store 0 fds in buffer [ 1445.764880] binder: 1528:1530 transaction failed 29201/-22, size 112-24 line 3475 [ 1445.765126] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.831678] binder: 1533:1534 not enough space to store 0 fds in buffer [ 1445.831708] binder: 1533:1534 transaction failed 29201/-22, size 112-24 line 3475 [ 1445.831947] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.838041] binder: 1535:1536 not enough space to store 0 fds in buffer [ 1445.838074] binder: 1535:1536 transaction failed 29201/-22, size 112-24 line 3475 [ 1445.838378] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.864201] binder: 1540:1542 got transaction with out-of-order buffer fixup [ 1445.864229] binder: 1540:1542 transaction failed 29201/-22, size 112-24 line 3467 [ 1445.864496] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.876472] binder: 1538:1541 got transaction with fd, -1, but target does not allow fds [ 1445.876508] binder: 1538:1541 transaction failed 29201/-1, size 72-24 line 3427 [ 1445.877531] binder: undelivered TRANSACTION_ERROR: 29201 [ 1445.878642] binder: 1539:1543 not enough space to store 0 fds in buffer [ 1445.878667] binder: 1539:1543 transaction failed 29201/-22, size 112-24 line 3475 [ 1445.879017] binder: undelivered TRANSACTION_ERROR: 29201 [ 1446.031746] binder: 1509:1512 transaction failed 29201/-1, size 72-24 line 3427 23:48:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1446.049249] binder: undelivered TRANSACTION_ERROR: 29201 [ 1446.066244] binder: 1545:1546 got transaction with out-of-order buffer fixup [ 1446.074024] binder: 1545:1546 transaction failed 29201/-22, size 112-24 line 3467 [ 1446.085827] binder: undelivered TRANSACTION_ERROR: 29201 23:48:43 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, @perf_bp={0x0}, 0x28a01, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r3 = fcntl$getown(0xffffffffffffffff, 0x9) lsetxattr$security_selinux(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:lost_found_t:s0\x00', 0x22, 0x3) ptrace$getregset(0x4204, r3, 0x1, &(0x7f0000000240)={&(0x7f00000001c0)=""/115, 0x73}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) pipe(&(0x7f0000000280)) r4 = accept$inet(r0, 0x0, &(0x7f0000000000)) fsetxattr$trusted_overlay_redirect(r4, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x1) 23:48:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:43 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000402000000000000000000"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1446.535112] binder: 1548:1551 got transaction with out-of-order buffer fixup [ 1446.536207] binder: 1550:1553 not enough space to store 0 fds in buffer [ 1446.536237] binder: 1550:1553 transaction failed 29201/-22, size 112-24 line 3475 [ 1446.536748] binder: undelivered TRANSACTION_ERROR: 29201 [ 1446.539308] binder: 1552:1554 got transaction with fd, -1, but target does not allow fds [ 1446.539345] binder: 1552:1554 transaction failed 29201/-1, size 72-24 line 3427 [ 1446.539526] binder: undelivered TRANSACTION_ERROR: 29201 [ 1446.542131] binder: 1552:1555 got transaction with fd, -1, but target does not allow fds [ 1446.542162] binder: 1552:1555 transaction failed 29201/-1, size 72-24 line 3427 [ 1446.542367] binder: undelivered TRANSACTION_ERROR: 29201 [ 1446.615671] binder: 1548:1551 transaction failed 29201/-22, size 112-24 line 3467 [ 1446.625434] binder: undelivered TRANSACTION_ERROR: 29201 23:48:45 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1f4995e772cba27b75ac7c12139e7bc3e0ab02aa00979fb34eed9db2353c15ed938d6c6847e686cc6e79ad7b371c8afcce11554433b4344e2ce5eeaa6209dfb0a310d6b20375cc449e6eb770c9f0e7910633dcb42b824aaafab0fc95c37bcda4ca4e2fa0ed572c27548c634da15f67d5deab09073060935c3ebe5d07b9f1f5783809399706731b43", @ANYRES16=r3, @ANYBLOB="00002bbd7000fcdbdf2501000000080003002e99000008000600080000000c00040009000000d00000000400040014000100ff02000000000000000000000000000108000200ff030000"], 0x50}, 0x1, 0x0, 0x0, 0x4000400}, 0xd744994a4ea47f34) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r6, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r5, 0x2405, r6) fstatfs(r5, &(0x7f00000002c0)=""/226) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:48:45 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@timestamp, @timestamp, @mss={0x2, 0x20000}, @sack_perm], 0x4) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:45 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:45 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xec57) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="006340400000000000003359660000000000000000000000070000000000000000000000004800000000000000d6feffffff0000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="0093b0f3e900001446140162a56bd9da4e65453825bd965b065b9189141f895e46a7c15c5022d5cf99dcde9dc0b70ed3ed8e12296c1708a03e39c002ffffffff3efa72000000000000002a6b4cbebb9f26cd6428134efe64ad"]], 0x0, 0x0, &(0x7f0000000640)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = geteuid() r3 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) write$P9_RRENAME(0xffffffffffffffff, &(0x7f0000000200)={0x7, 0x15, 0x2}, 0x7) r4 = inotify_init() r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r5, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r5, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r5, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) fstat(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r3, 0x0, r6) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000140)={0xa0, 0xfffffffffffffff5, 0x7, {{0x1, 0x3, 0x10, 0x9a0, 0x1, 0x5, {0x6, 0xffffffff, 0x3, 0x8, 0x3, 0x101, 0x5, 0x0, 0x8, 0x9, 0x7ff, r2, r6, 0xff, 0x9}}, {0x0, 0x2}}}, 0xa0) 23:48:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1448.763359] binder: 1565:1568 got transaction with out-of-order buffer fixup [ 1448.772120] binder: 1560:1562 transaction failed 29189/-22, size 112-24 line 3138 23:48:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:45 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0xfffffffffffffff2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x7ff}, 0x0, &(0x7f0000000180)={0x1ff, 0xfffffffffffffffe}, 0x0, 0x0) [ 1448.772565] binder: undelivered TRANSACTION_ERROR: 29189 [ 1448.821643] binder_alloc: 1578: binder_alloc_buf, no vma [ 1448.821662] binder: 1578:1582 transaction failed 29189/-3, size 18432-281474976634368 line 3284 [ 1448.846536] binder: 1565:1568 transaction failed 29201/-22, size 112-24 line 3467 [ 1448.857080] binder: undelivered TRANSACTION_ERROR: 29189 [ 1448.859082] binder_alloc: 1578: binder_alloc_buf, no vma [ 1448.859100] binder: 1578:1590 transaction failed 29189/-3, size 18432-281474976634368 line 3284 [ 1448.870637] binder: undelivered TRANSACTION_ERROR: 29189 [ 1448.888438] binder: undelivered TRANSACTION_ERROR: 29201 23:48:48 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:48:48 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r7 = inotify_init() fstat(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r6, 0x0, r8) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='fuseblk\x00', 0x804, &(0x7f00000001c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x3200}}, {@blksize={'blksize', 0x3d, 0x400}}], [{@obj_role={'obj_role', 0x3d, 'eth0'}}, {@subj_role={'subj_role', 0x3d, ':'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/binder#\x00'}}, {@fsname={'fsname', 0x3d, '/dev/binder#\x00'}}]}}) ioctl$UI_DEV_DESTROY(r1, 0x5502) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:48 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) tkill(r2, 0x29) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) r3 = getpgrp(r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x563c, 0x2}, 0x803, 0x0, 0x0, 0x1, 0x1004}, r3, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0046209, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x8) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) socketpair$unix(0x1, 0x6, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$sock_inet6_tcp_SIOCINQ(r9, 0x541b, &(0x7f00000001c0)) sendto$inet(r7, 0x0, 0x0, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) sendto$inet(r7, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r7, 0x6609) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) [ 1451.788425] binder: release 1596:1600 transaction 1043 out, still active [ 1451.799411] binder: undelivered TRANSACTION_COMPLETE [ 1451.804905] binder: 1594:1599 transaction failed 29189/-22, size 112-24 line 3138 23:48:48 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x6) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) fsetxattr$trusted_overlay_nlink(r4, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x9}, 0x28, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1451.815137] binder: 1597:1602 got transaction with fd, -1, but target does not allow fds [ 1451.815175] binder: 1597:1602 transaction failed 29201/-1, size 72-24 line 3427 [ 1451.825120] binder: BINDER_SET_CONTEXT_MGR already set [ 1451.825129] binder: 1597:1602 ioctl 40046207 0 returned -16 [ 1451.825183] binder_alloc: 1597: binder_alloc_buf, no vma [ 1451.825202] binder: 1597:1605 transaction failed 29189/-3, size 72-24 line 3284 [ 1451.829053] binder: 1611:1614 transaction failed 29189/-22, size 112-24 line 3138 [ 1451.838879] binder: BINDER_SET_CONTEXT_MGR already set [ 1451.838888] binder: 1608:1612 ioctl 40046207 0 returned -16 [ 1451.839151] binder_alloc: 1596: binder_alloc_buf, no vma [ 1451.839167] binder: 1608:1612 transaction failed 29189/-3, size 112-24 line 3284 [ 1451.880033] binder: BINDER_SET_CONTEXT_MGR already set [ 1451.880043] binder: 1616:1618 ioctl 40046207 0 returned -16 [ 1451.880377] binder_alloc: 1596: binder_alloc_buf, no vma [ 1451.880397] binder: 1616:1618 transaction failed 29189/-3, size 112-24 line 3284 [ 1451.895676] binder: 1619:1623 transaction failed 29189/-22, size 112-24 line 3138 [ 1451.994489] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.000014] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.005591] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.011148] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.016724] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.022226] binder: undelivered TRANSACTION_ERROR: 29201 [ 1452.027733] binder: undelivered TRANSACTION_ERROR: 29189 [ 1452.033276] binder: send failed reply for transaction 1043, target dead 23:48:51 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @flat=@binder={0x73622a85, 0x100, 0x3}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:51 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x92) write$binfmt_elf64(r3, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0xfd, 0x2, 0x98, 0x5, 0x7, 0x1, 0x3e, 0x9, 0x3d3, 0x40, 0x3b5, 0x7e64aa1b, 0xfff, 0x38, 0x1, 0x7c3f, 0x0, 0xfff}, [{0x1, 0x6, 0x3f, 0x1, 0x1, 0xffffffff7fffffff, 0x40, 0x54dfe80b}], "7cd0446b74f73463e6262a1e47eb16026be2f431abba5d3d6ab09165955d28856c92cc9ecf99b1b10763cecbd24dd99c27113f0f0decc2268923fa4676d120b04c79964bfcc2a31eb88e1471f5d1d6ebfbfac45dc17d192bf3cbb249e8b5f73fdc366967e480e6bd27e25d51e5b5bbdebb163adcfc8c75c019c43532b8ef23afe660c6c94f58d24c569608ac2b1562dc629dde137318a1f42347878e899b15f374bfdcb6792b46f232007493decff81215ae59296a942c", [[], [], [], [], [], [], [], [], [], []]}, 0xb2f) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:51 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:51 executing program 0: r0 = socket$inet6(0xa, 0x2, 0xfe) getsockopt(r0, 0xff, 0x7f, &(0x7f0000000380)=""/73, &(0x7f0000000400)=0x49) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) [ 1454.812140] binder_alloc: 1626: binder_alloc_buf, no vma [ 1454.822941] binder: 1626:1628 transaction failed 29189/-3, size 112-24 line 3284 [ 1454.834892] binder: release 1629:1632 transaction 1057 out, still active [ 1454.834897] binder: undelivered TRANSACTION_COMPLETE 23:48:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x108048}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r3, 0x200, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x81000}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000000}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/115, 0x73, 0x0, 0x1d}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x28, 0x40}}}], 0x63, 0x0, &(0x7f0000000240)="10d18e83341d6a05b5dc58c6422b05dd1d335537b2ac302f3490aef1287650ff277011d7d7e1e7c93754eea9fb4252d9e596cce06ca41e364ed47e10fb483cd74fe1c00520c3d0489095d4be365245c28c6ea46c8142e5b7f20b07569164ee34af315a"}) 23:48:51 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) [ 1454.839824] binder: 1627:1634 got transaction with fd, -1, but target does not allow fds [ 1454.839859] binder: 1627:1634 transaction failed 29201/-1, size 72-24 line 3427 [ 1454.840009] binder: undelivered TRANSACTION_ERROR: 29201 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:48:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x140000, 0x0) [ 1454.842734] binder: send failed reply for transaction 1057, target dead [ 1454.850494] binder: 1627:1638 got transaction with fd, -1, but target does not allow fds [ 1454.850531] binder: 1627:1638 transaction failed 29201/-1, size 72-24 line 3427 [ 1454.850775] binder: undelivered TRANSACTION_ERROR: 29201 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:48:51 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000100)) getsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000), &(0x7f0000000040)=0x4) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0046209, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1454.875526] binder: release 1641:1643 transaction 1067 out, still active [ 1454.875530] binder: undelivered TRANSACTION_COMPLETE [ 1454.880394] binder: send failed reply for transaction 1067, target dead [ 1454.908985] binder: 1648:1649 got transaction with too large buffer [ 1454.909016] binder: 1648:1649 transaction failed 29201/-22, size 88-24 line 3493 [ 1454.913036] binder: release 1652:1656 transaction 1071 out, still active [ 1454.913041] binder: undelivered TRANSACTION_COMPLETE [ 1454.920970] binder: send failed reply for transaction 1071, target dead [ 1454.961703] binder: 1663:1664 got transaction with too large buffer [ 1454.961731] binder: 1663:1664 transaction failed 29201/-22, size 112-24 line 3493 [ 1454.961945] binder: undelivered TRANSACTION_ERROR: 29201 [ 1454.977292] binder: 1666:1668 got transaction with fd, -1, but target does not allow fds [ 1454.977332] binder: 1666:1668 transaction failed 29201/-1, size 72-24 line 3427 [ 1454.977845] binder: undelivered TRANSACTION_ERROR: 29201 [ 1454.990674] binder: 1666:1669 transaction failed 29189/-22, size 72-24 line 3138 [ 1454.992013] binder: undelivered TRANSACTION_ERROR: 29189 [ 1454.994274] binder: 1670:1673 got transaction with too large buffer 23:48:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1454.994300] binder: 1670:1673 transaction failed 29201/-22, size 112-24 line 3493 [ 1454.994421] binder: undelivered TRANSACTION_ERROR: 29201 [ 1455.046678] binder: 1675:1677 got transaction with too large buffer [ 1455.046707] binder: 1675:1677 transaction failed 29201/-22, size 112-24 line 3493 [ 1455.046849] binder: undelivered TRANSACTION_ERROR: 29201 [ 1455.159995] binder: undelivered TRANSACTION_ERROR: 29189 [ 1455.176246] binder_alloc: 1679: binder_alloc_buf, no vma [ 1455.181940] binder: 1679:1680 transaction failed 29189/-3, size 112-24 line 3284 [ 1455.191041] binder: undelivered TRANSACTION_ERROR: 29189 23:48:54 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:54 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$cgroup_type(r3, &(0x7f0000000040)='threaded\x00', 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:54 executing program 1: mknod(&(0x7f0000000080)='./bus\x00', 0x8, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) lsetxattr$security_capability(&(0x7f0000001340)='./bus\x00', &(0x7f0000001380)='security.capability\x00', &(0x7f0000001440)=@v3, 0x18, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setreuid(r1, 0x0) execve(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) 23:48:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x1, 0x4]}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x81}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x18, r5, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:48:54 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x25dfdbfe, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x33}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:54 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r2 = inotify_init() r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) inotify_add_watch(r2, &(0x7f0000000000)='./file0\x00', 0x4000082) write$nbd(r3, &(0x7f0000000380), 0x10) sendfile(r3, r3, &(0x7f0000000200), 0xa198) 23:48:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffb1, 0x18, &(0x7f0000000000)={@flat=@binder={0x73622a85, 0x0, 0x1}, @flat=@weak_handle={0x77682a85, 0x1100, 0x1}, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1457.863309] binder: 1686:1688 got transaction with fd, -1, but target does not allow fds [ 1457.871765] binder: 1686:1688 transaction failed 29201/-1, size 72-24 line 3427 [ 1457.880300] binder: undelivered TRANSACTION_ERROR: 29201 23:48:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) getegid() [ 1457.906342] binder_alloc: 1692: binder_alloc_buf, no vma [ 1457.922449] binder_alloc: 1698: binder_alloc_buf size -48 failed, no address space [ 1457.922460] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1457.922480] binder: 1698:1699 transaction failed 29201/-28, size -79-24 line 3284 23:48:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000080)=0x0) ptrace(0x4207, r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00\x00p\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1457.922721] binder: undelivered TRANSACTION_ERROR: 29201 [ 1457.924584] binder_alloc: 1698: binder_alloc_buf size -48 failed, no address space [ 1457.924590] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1457.924607] binder: 1698:1702 transaction failed 29201/-28, size -79-24 line 3284 [ 1457.924886] binder: undelivered TRANSACTION_ERROR: 29201 23:48:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket(0xa, 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='B3\x02\x0fv2\x00') getsockopt$SO_COOKIE(r4, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300400000ff8dc3b0b1992623a02e942a7880c8258bfbb3842979088d7fe134455c1e8e45625205304410bb96ca08ddd01004dd1c1cde925561d99faf3e302f2ee0b27323ad2fbf0d31086dd5f52836e72aaced47b97d0c2ff77e441f11851922e4aa4f2f1369cda928e0e", @ANYRES16=r5, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x44}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x84, r5, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xdcb3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3fc00000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER={0x18, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'netdevsim0\x00'}}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x2000}, 0x4000080) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1457.956275] binder: 1704:1706 got transaction with fd, -1, but target does not allow fds [ 1457.956489] binder: 1704:1706 transaction failed 29201/-1, size 72-24 line 3427 [ 1457.956730] binder: undelivered TRANSACTION_ERROR: 29201 [ 1457.957719] binder: 1704:1707 got transaction with fd, -1, but target does not allow fds [ 1457.957750] binder: 1704:1707 transaction failed 29201/-1, size 72-24 line 3427 [ 1457.958055] binder: undelivered TRANSACTION_ERROR: 29201 [ 1457.980902] binder: 1709:1710 got transaction with fd, -1, but target does not allow fds [ 1457.981054] binder: 1709:1710 transaction failed 29201/-1, size 72-24 line 3427 [ 1457.981374] binder: undelivered TRANSACTION_ERROR: 29201 [ 1458.168940] binder: 1692:1695 transaction failed 29189/-3, size 112-24 line 3284 23:48:54 executing program 3: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1458.179311] binder: undelivered TRANSACTION_ERROR: 29189 [ 1458.195923] binder: 1714:1715 transaction failed 29189/-22, size 72-24 line 3138 [ 1458.208247] binder: undelivered TRANSACTION_ERROR: 29189 23:48:57 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:57 executing program 3: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0xed1b117536240d9e) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x10000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000004800000000000000a00171cb14180000fa3a61f79d313e48a2b91432e3a5a1cc12eda442933b273afc933e2cddf5fc61a1da547d411f4e5571", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000024bf696f000000000000"], @ANYPTR64], 0x0, 0x0, &(0x7f0000000640)}) 23:48:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r2 = inotify_init() r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) inotify_add_watch(r2, &(0x7f0000000000)='./file0\x00', 0x4000082) write$nbd(r3, &(0x7f0000000380), 0x10) sendfile(r3, r3, &(0x7f0000000200), 0xa198) 23:48:57 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f00000000c0)="390000001100090405fe0700000000000700ff3f03000000450063ae0000001419001a000400000400"/54, 0x36}], 0x1) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000340)={0x1c, r4, 0x8, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000084) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x18}, 0x10) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r4, 0x200, 0x70bd25, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x2) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:48:57 executing program 3: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:57 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x33}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:48:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) r6 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000200)={0x0, @multicast1, @local}, &(0x7f0000000240)=0xc) r7 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r7, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, r7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a6273000000000000000000000000000000000000000085613ce154784f34d937cf081935f44943fc20dfdc9d07a0ec0b9a8704809a1cd577cac8b2672ef86713f61e50b7668ccf0741a5a35e0d807578074b6b26708b4b00"/105, @ANYRES32, @ANYBLOB="000000002b0000faffffff0a01007773349da76fd19330444b945f36e87c3e71", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="e44352773ebe3ae3da9b35697efb9b3a0b589e76070fd6c8ab8f476121f0", @ANYRESOCT=r2, @ANYRES16=r3, @ANYRES16=r4, @ANYRESHEX=r7]]], 0x0, 0x0, &(0x7f0000000640)}) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpuset.memory_pressure\x00', 0x0, 0x0) sendto$packet(r8, &(0x7f0000000180)="ab4d5f641347086ca9f46864c1fa5a541063661cd15d8d4043f92747c8816843b77c7abf55ba6a7a65d8df63beb59cb814903f24125a2778dee472af2d72c1624ea5c73e219da7", 0x47, 0x8000, 0x0, 0x0) [ 1460.872214] binder: 1724:1728 transaction failed 29189/-22, size 72-26477591593376 line 3138 [ 1460.881571] binder: undelivered TRANSACTION_ERROR: 29189 23:48:57 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:48:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000400000a98a52914bf1a9b3559c730abc5d2534cb6bd5d746c660a80cc34ac5dbaccaf99cd8bf84d92fc2ed6ffd0100"/73], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) write$FUSE_WRITE(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, 0x2, {0x2}}, 0x18) 23:48:57 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0xfffffffffffffffc) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1460.992832] binder: 1747:1748 got transaction with fd, -1, but target does not allow fds [ 1461.001737] binder: 1747:1748 transaction failed 29201/-1, size 72-24 line 3427 [ 1461.011071] binder: undelivered TRANSACTION_ERROR: 29201 [ 1461.018782] binder: 1747:1749 got transaction with fd, -1, but target does not allow fds [ 1461.027834] binder: 1747:1749 transaction failed 29201/-1, size 72-24 line 3427 [ 1461.036743] binder: undelivered TRANSACTION_ERROR: 29201 23:48:57 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f00000000c0)="390000001100090405fe0700000000000700ff3f03000000450063ae0000001419001a000400000400"/54, 0x36}], 0x1) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000340)={0x1c, r4, 0x8, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000084) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x18}, 0x10) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x50010001}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, r4, 0x800, 0x70bd25, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x22}, 0x4000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) [ 1461.099417] binder: 1753:1754 got transaction with fd, -1, but target does not allow fds [ 1461.121092] binder: 1753:1754 transaction failed 29201/-1, size 72-24 line 3427 [ 1461.131642] binder: undelivered TRANSACTION_ERROR: 29201 [ 1461.154242] binder: 1753:1763 got transaction with fd, -1, but target does not allow fds [ 1461.174582] binder: 1753:1763 transaction failed 29201/-1, size 72-24 line 3427 [ 1461.193182] binder: undelivered TRANSACTION_ERROR: 29201 23:49:00 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) tkill(r2, 0x3b) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:00 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace(0xffffffffffffffff, r2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:00 executing program 1: r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001e0025eaa87865f51ef6bce90a04000200bff20182a9000c080009000d000000", 0x24) 23:49:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r0 = getpid() r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e15b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, r0, 0xf, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) fsetxattr$trusted_overlay_opaque(r3, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = inotify_init() fchmod(r5, 0xaedab68aa5282ce0) r6 = dup(r4) ioctl$TCSETSF(r6, 0x5404, &(0x7f0000000000)={0x8000, 0x5, 0x7ff, 0x20, 0x17, 0x0, 0xe1, 0x88, 0x3, 0x3fff8000, 0x4, 0xe53}) prctl$PR_SET_ENDIAN(0x14, 0x7) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r6, 0x28, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={r7, 0x4, 0x18}, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$PPPIOCDISCONN(r9, 0x7439) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x0) r10 = creat(&(0x7f0000004800)='./file0\x00', 0x9a) getsockopt$packet_int(r10, 0x107, 0x1a, &(0x7f0000004840), &(0x7f0000004880)=0x4) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={r7, 0x3, 0x10}, 0xc) fstatfs(r9, &(0x7f00000003c0)=""/231) syz_open_dev$binderN(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r11) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r13 = dup(r12) ioctl$PERF_EVENT_IOC_ENABLE(r13, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0x7, &(0x7f0000000300)={0x3ff, 0x40, 0x0, 0x5}, 0x10) pselect6(0x40, &(0x7f0000000380)={0x0, 0x5, 0x0, 0xfffffffffffffffe}, 0x0, &(0x7f0000000180)={0x1ff, 0x0, 0x1000000000}, 0x0, 0x0) 23:49:00 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:00 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r3 = inotify_init() fstat(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r2, 0x0, r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$FUSE_ENTRY(r6, &(0x7f00000001c0)={0x90, 0x0, 0x4, {0x5, 0x0, 0x80, 0xf2a, 0x7f, 0xffff, {0x5, 0xffffffffe289f6f3, 0x508b030b, 0x4, 0x7fffffff8000, 0x4, 0xd9, 0x7fffffff, 0x1000, 0x9, 0x7, 0xee01, r4, 0x5, 0xe0000000}}}, 0x90) pipe(&(0x7f0000000140)) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0046209, 0x0) r8 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="fc"}) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r9, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r9, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r9, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$sock_linger(r9, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 23:49:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0x0) munlockall() 23:49:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000002780)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="00000000000000000000000000a03db4b9032afb6c3cdabb596825e830312bc0d22d932f3f847cc91ae563c2633066459a2d81141fb3eb5d8c149669830d"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10, &(0x7f0000002700)=[{&(0x7f0000000700)="3e3a0cb5935697ab2b3ba2854eaa06ffaaf3b533758fd53e298d54312457489776663f31f7722ef99f901f7fd3170accee2600ac89255b8c9829be4f61ecbbba06949e6be945ac1ef2068643fee06d48c4f11cce3e646c86569c906a76cb366860f36544d5a4dacfa2021aad50552a6ca9c6b4f06130fc0f783d1d429a962f5145e4d9dc4efcc853b8f6d5180fb40a8a45b9160712e08960d7a3b73dc2330233caaa13c732cad58971121c6f6cdf95b70362245c34434dc28146261a2f9b1f16dcb5583533c781c15c0ec4ce0d2d4a207b085aa9c7558ff4459e25ccecf7818d8aba06cec8dedb326acedcd9b16fa0dbaa2ce138b473df5530756d238c6e2c35565c0bf539c56c8cf8ba22e14a4f7b6f107a823a8106edda4fac79613d63379a1938391710c0f3ce93ef2e98ff7902ab66e76efc8ece8980e490e3e2460930d498dc0c4076325fdfbc15cb4a89a84c053720f6386e5ef37657afaf1898a560851b1836ece7cc68582814b1ef713ae7e4355050791b2cdc6f4487f44f0650956e4dc8bd13c102435803901a86986318aa1ecddbc81eeabe7498244551cc323462549781c6457117ee73626feba32b55fc7743f80cc406b92c66f85cd99547eebdcfd55fc308c32035d5f7bb76d780ee3b5a720112eee0874e4a2205a81f4c8f1a7f03bd5d8bb73f5e8e41ca07d1f0e24d9e9eb8dec872746332132ee9ab79f23ebd39ef6700a2ceda6b31ec3c6b310f5b8c90b964d7258038c29a4adfb71958746c1b10f83cfca183a5acea425b02e4ecd3525e4859455eaf207f230a9a26d699cd5c3fe9af6563973da075d0931556c5dc93236824c0dbd47f2583493bc8c38b3f43d5898f050a1eb2fa35fdc29ea40a79d04bac7bbd0b92e67c45d546bad25d4a748247ec49267bff6307c766111d83954e7547391d8fdb82c1df7c73531d1f3ebc39c50dcb08b17b1f674431397af8547166bf2bb2f76e8b04cde5b7d993b5f0dd88cdb19ed55b2e81a6ad2fc0b3988483c5c0f305d39873f33a560c07d1341f344e4f0eb7333f441f3b145d2ad6d5d4950bd03d14181702457f8c3ad423acf8b265eba89efce5764f829ac84131f5a0e19523ab4d654f21914b1bd88a48ec10e5c5ed2b59e6dd478668570c0139d47cc6c5d84eccf0e622ca79d63adc8f6fa7d92126263478c97efd58d5793b0181c5af95f45d8fbb930daac4023fbf4bac22e8885c2e904cd38ea107ce98b738d306c27d57907ce059cb2c5b7261f939be43b2e85b6d6e8b9e811415444f49653844b970101576ca0b0ce2464dd197e5b560a18fec7a98fc4bf14e0b6824c059544035f5a724014160602a3700e992bf96118b5d4d8c930b1f823df33f209ebdc9064057a3fa8d0d19e323d0acfec52e0161429786c3365dd6298e7ad3ba25b1f001fafc6d39cd2bcb648a710747918c2a6d565c514155038b79713122b78fd19bf0f0be2af162cb63ded22818e2b6ff00ca00a59ee7cb833b47dd07229cc7c6a35e11f8b4cdb3a730ff4c2f88a49c1cb8d73a2350908d2a7f27edd14bc71c2a2e0d60b8e9999a98aadcace6044f6b7abebab51695972c6a26c5f9e730344e1bd83cdb4c6082aec90f6dd881bee7f12ba4ef17bbba5431008506b56fb77445e60c10a2fa42a1cb1eac1ea51eaf6a26e2339584a22075790d08ac82b3d963275dc248830ab3ac556c7b7175974731e74b999816bf84ad2e20f45a9527f99e8d9c38675d37d80a9726f19cc7133af9f2fb083d888843ed21090c7ceaea37bd1b48c34fd68ad0a35212e097080aee26d745f0ad3ac00a38427ea6eacccea241c28ae19bd316880439c48e904757e8fc4b44c17978be6fc8c6befae5848058d8964f838390c099a3ba64f62e823314296dfbe5d7ad61076b00f2ec503b618cb27a72f14ee30b6165a8a42cc5a7790c1feac823e0734b618896800ef95f47ae4580611ba050d9c2e3fc7b8bb71014bfbb7d3b2bbe02c878b9698b1196d6308ebf20c5a86bb5ef0986441822507f8ca99404b48ee631c8207719959da9777a98eb6ca7a8e22a7800af300d1ab27085f299aed47faad1e03844f829fb1d784330fe69bb525c156d4f008e88ec20b60889f3d84be0ea4fb8a4479636a706b10c62835f2b40c1ad989eb9b82c15efc238bccfa3d1a965dec204699f9e042ea3712eae802c8525a2e2e40c7aa2dfd022ccb73400589b6cf820a21c0f5947cc83867786ba144b02d01cb8fdd5dfa11db5307f1d0797b0c61b1684d001908d84a955ed39db5efde0d41a9ad496cc5676c143a81e3fa4df47ab344db768341e9df6c9319bf186b9139f9d3cc453f95ee12277296544802c1b45eec08d6638c368be33b0868120993db6b7962b609a8b5dc55ed42adcd89de38f057f97b0c4400f21cb53c6bf32c2ee9f1b62bb0fc47149907bc903652a625df9bf102c1957d21399a0b941b487115bf73163e70e0897d39e362a21290eaa6917d0c18100148ea28f6e7dced9e55c82e5915a706642544d246177896692c0c464ce0e17c7c0d898a29c9be32c65192d6f926e5ad61b0f79c5eaa215fa19c59be42690122d6efd74f81b6b45d138bff8a4d02b3a4201f50fdfbd7f6a82c251d38a1309d906e25b8c08edee9a66cbe78750ecbad6e3e128968e977bc57ecb0b38a0df53dc533db7234464846aa8203fb25d3338867bf7c466f4dfc57de0b3ff31d20e6503824edee3627a4fc0b5c804bcdcdf917bf15d67459cd25d1e8266f8479ebe22971d4ceac6bf52114e9ccd2680eef06b283cdd89e7892deb3e8fe213353a01a4f83c1ebdd0913fc14a6581cab337bba20da8a50ee228595b377ce04514236febcc721f9e6e032cf64ae7d2795f582156069923640e2e3902818367cc8e4b0608740503eccbc8bc4ce3300e74ea3d647d3f24e172491d94354ab8ac10eb0da8d66784d13887bcf6e80bd14c75da0934261e9a198fb47d810e4391b2230fb14918c170ea07a71b4241df95c283ff6c29cdc1061cd21ec4c4bd916b1030c64955555a74e70fcb07bd46fbf204f1ad1a84eccd7f320ed9effc9985c3438d38d3004f48e0c2c348ec6c667f922bb5d04d8b0b3be2246b9413e1985657668e1fd360af920c7fe2109a8a0c397c7f46cd623893b96374c3ac09687051f37c14d1b43ca8d35c5a7a80b0bbc9dcc448f6b2d377c5f8f19affdf48bba506ca919c10a1f74809456b0ecd16d9e0dd57161dfbcbba9a4b66fe7c64cdd857d22384b50865d8b807cbd93286d981ffc2b445566ba9adc21838774d7d4792c0b20e936c6daa4d919796f6f50cead7d6ead1ca07071d718fe46f1ba5d7bee71712197bb58caacbb6273229bb1f22fa50e828ed3409a10bba7e04c5372c0893cba7715586e7ce7b409582dfb474ba60a7e9f6853da059b8b02c758361d5b6aad34115b79fd6d4ab97193c7ca707f55a416abe833c3209ff3a9149d5d1a2066cd6e842e4ff40e45665121d3eb07382027bff223feddf0b8d379274341571a8164f8b0588b7e7acb515e6f61b9708108ed31871332f7205edc224ca21c06f5f7638aa8fc479c8c1387a4746d07e615a987b5acecf4d79ef33733a67acb1aaa073f762434f5dbbbaed51b89851c53cb6de26f4a04904a4f9d001f4e454c1bcb4c4c08fa4c77b906d4ea5fe36f548debc08dc2533d946a4284d5a393da5d91e66460e52ca16de2b76083e02030e89a804b432ffe493db0ead01d1504a9737ea58257bd450f47b800faa80c081f09100e95477fcb6e540c44c4bba6476f528d109f0aa609606704b482f1f34feae0b1ecb9eb5a48d8a92a90bfbca3233cb312489049dd31ce292ee7b21c1ab7b517dede5474b6baac5e36b69b1186b2ef05d75373f93e70f5206373461e7ab7a83001d2eee12428ff636d26c9983951805f58704a914965cff6b02725435a3e78e69addcc5f6cad54595c653cc745c6cb1659142f3efd3c05def20da9fc67fba49bd4c34adac74e18a1dbff44da7b52d5bfecfa4262f1a70b41bb9e0a1a45d4f5fd571777da185d79a794e083246979936d59099610ea6b7d0e9e79c7156a0a54b72f0f746236568e712a9e51054a401807256815b8755839a9c41e766089d2a7d1d116c58e72f1aa760252dd2c2b837ce6ed892aa06868f2353eb12dde3515b6c0113a9dfda7b2a9d0e8ebcd8148f4fa385c905e3b1cf1f43173d74c222fd5befea531ed9edc6c051eb34fa359fc570b37e8581b0efbcc131adb1e6a9469b4be36418d5df298a6c4cf35fefe58e5d2fdb59b6c7012f27f92fcd0a7d03b2c012bf0ceae14614d21999317402ace67f79b9306f19b2ae38aed585791db9df929b1d25e793bef21112ae3cfaae11313ab4cfba65628438b2fc9972c9750a339ed0c5640f5d773fa14d9f2620a7a3c66e7e10cf34e8af27304a51633b87827a8c6717972f2815bcdd76044ad91b0fabbd4c56f61364efa867b5c5a3cc9736c9edf6c6bc2835a74f279f883e9511e85bedf1eb3ad1d62ce78cf79538cd74d3d0f9ae80ac2ae16ed03a5fd5c77b386c1620f6358a6759b732a49209c98497fada189dd94c8a7e37e29563fb52c53e46126c9493d943799aae3dbb3cd1fbde7af520b601b367daf9ada5a202f6f9fda10ebd9073b56e088040bf91dd983b8e0f198c0b3bfa25557da6bdb18bd8d9054736e68c43e495ef7f1931b4ac87ac95c35762d0f6a616b7651e59fe9240ee2b36240e82f8925c2627a5016319e5715c96bdacbeb5ede95474c6c8a8336bde63f99f4ba3c54c68b9710d9ca1b8a29975dc46adfce8bdabfade7afd75df18b708fcdfe63dcda9da2217e87d3a65252478e28f65070aa22bc011638af1d28598193eebf649f495604f64c1c0dcbb421f37b646aa4cc65db14e77b1be2671e44000ba6a692f8311468cf015870a48bd63ed8f0cbc6c682582ae7c1c9a8ca4b2ae95ec9fdb981030cde5058d6630ff3c3a2b47e33ceab2a5459b60cac8e41b62ffcda1332def24da4612e07f3cc8f5ed08d7e1f26a2a91875e4ee3fb6a5d9f6b5414a39f69309105ff08064dc601c8c84c9b274591d57796026fdc45da83a0e081e23588c8154e7b28c6a621e08aac44279871d16ff1e610683c50b1124e5678d556eaf4ed87186cb4eb849cbff7763de8e215b9b10bafb02dafcd442735d22ca4455c5bbf662d57d75ea81728d2fb583570e78e7a0362b43d991529fb2b7760d436aa1d4435c16f05aff8c36023639cfaa24dddbcbbad04f3d88f060f5f03dce9c2fd24c5bb1bfb456176a7fb0f8aac6cc27a46d280c7b33a5b49cd8b8c5422d973994d5912637b897156e3d26030714ae55ed996a255386575352d2cef6e954e238634d42824837b7182ecc25e1de9d6d29e9be1ad9c4fbcb5e21bde1190712675ed02e89fb5f9e01580888d732623034fefbb3d437d1b8337eb9cb0c1538d0792ad94d925aeba109d1d1a0116549cbffcd8563fcac9b65521734bc3e281a541c9a72f61e3a65519e87c0f42efe69207e47077ff28823dc13191414d4bd04f423018fc46f4ef459facc8fff9d4bd7fc2679dbe2bb50d430f3c7c0115ba13ea836c95f5107396bfdb643f168c1411e9bc6af456dcf922abc47975c16b938e42fff4429980820716bd65e52ba7c7019c51c609aa21ad78c7f524db741dda2741b468a261849f2aa2d65244c608f1b2799abb02ff5463b58e3c9ad4e1d5a5e5c88b89d055238b38b688ca37f509e7318ecc046931819b85d6d2f223411333425de9903d07ca65bee3dbacca6a2527cff3", 0x1000}, {&(0x7f0000000140)="aa6e51c537a75d321a143226d4b9efefca534d734a0189c551ccb0fe8eb94e76ea7f8ccaf4567068e5ff1d795469612f054563a410c836a1b014b9d0897d23bb115af36a05a3fce4e66de25b3ba7aa84d9a8912e8145c77e574216141dea6a76aad1bd8bf2b47cf2a28299b53f61f7f065d47a30350ab55d5d8cc1fe3a82f53e05", 0x81}, {&(0x7f0000000200)="fefb2b165165e38de640a75ee1def465d796481535b9e2d1772415adf4a5303335c58baa0d617af4a5e2ad21c8104f0550259e3b044618335db19cf61d65e654673beb7b3ff27f5186af45d8463516d3ba3d345d35043942e06bd8668d10d08f2b8e17d146550cc31b50ca292eec9c97cb37499a1f509ee0af2064d710889218f93e25", 0x83}, {&(0x7f0000001700)="7a49a866f702dbbcd1cd4ea8fe40057a45a371b917c8856da986d9c037b6f1413b454cb140824a12a30f4566d95d2a431c06502707fc10b3e2b260c5ab517fc2a52af6fe6b25a4b10fed4b1a2384715a93055e8b9665c11c25adb1b931642f1996a41bb098ff50cf80789b90d196f3b9d736743b3a4e2f2f9e3086577e01213f0d6740032a24a0e98e4c9ce7773b58404b7694cbb01f5e0a6031270928896381893114a83d11f4e89475d2e18d8aa3e11ff9b60d7f6c4d7e1d93148ca2a050bf5903b6ca47920790fba62fcb7a02085404690ef1a49cb53f58c19734b3f5c9c9937b42d4ad71e60f18e64c917443780d56a915e15a754bdb65648def12bdb8fa78df9417c2c55bb0b234ef4b83ec8248a8f4e46469f7573f726009e97ddf16aa600d2efa8a6ceb10a5600ea4f72cbfd973c912511a7103e69879e238891a715d8679f0e1640fc67572c58e0d901577a7919988ab801594f6764795a84d3e99a48168be4d7a61b90e9070ae3a7e8330df17245d6926827edc9a74ce0cf8b69511332b9fd56a409493d4aef9bcf82e16da1097e463bf3c7f945393f099cb5ea83a9c871d3f4f89c7f038e277ef887fcc7995a71c7e1ee7e3b17487294ed4300d3d975e5baefde540c7af539dc9eaff2d12be9485ab084c79fe13faa15be1cb67ece1eba9b54f857aa9a52f58df4ae9aeab9a0ba05782a21617424dacd73b82a5f202fc8bc30322869be0b6892c2a1703d02dd691310edf2b42051970dbc6c2de02992fa3293daf2c6d122d9d3e46b3e44fec40790660187dbc9fd1ee26753e81cc9d8e1add7b495ea07d64b12bd2a86b0f3d359955b87598598e6b04b387e70bf2f03a0080ae5cd166c4c5ef93e952b8de47f321d616ffce63946930e5f170c46b2464d59dec719522ebe0daa76a22fab1178352a7d27bf376453573a40e78f1bb0406964f8964ed8e819fae131d3db93b40fa12b4a411a6ed9dea9ca953b799631eb157b47d6eb763291018fae5c8eae4730b9a95fd2d15def835aa1ccb0c3f3b79fe98b0d0a935074bb0e119963a0cb36275b759d5ae90dbdbcc388069ad6b38ddaeb3dd69768aab8c152e3a62de64c5ecb9090b2f50a0a42ef5422ccc7bd65dd4e3a0d8c3156f26e834e5ebddce16e36ba72048c5f2ef842faa615134107c77ca2e142778472795a3ec62636aee4cd875b2707452c724c4040b53c4e88aa2e3efd24d5c1a13264a8e7db6879f0a2fb4e6d49e6977059b44c6ceae6d73fffd18ec75edac43021073c3a20d2812b149373537b6f00ff0582e9bcd1864c1db80812a0864b7b799f0663cd34203ba861f83548db217641d5b64d61647fc51b7e13ba3ff478c155e1f365d4c251b2c8397b0887b1b7e37fc4a51d8f81c10b17ad91d1013e104d591c0e98cf2f2a34be1e64fd35e6258ec4f3d899b3b49ad773f75a83a80b407e39c9ec8be53bbc0ff362700e0f92dd2c44d27ff33b664036a6f1cfb24476707f06f184ff8ccbe2d2bfa8d94f1598ea9253c1483208a90c7b645baf7ce145d6fcd409b95b3878aac3be3bc17826a8696c98f5e6ae24fc39ee510e14ed400757497d962057a8e377edbec5bcfba80045c3c46562b64fe587c4a7e0cc8e38afedb18a473ae71640df520574eea59657c4ec4c0beaf45b1c98366947de7c64f1431396d90d6924df9eb0d2debbeb7c45d1d2d4ff27fd14087caeac6780fbd540e607336831f2ac5aa304e0a96292ec5d65e8ce3c1b3a08d32168bf0efbb155e1907efcc1e3632b2a08733ac2bf0a163bbb37fc907061f0097001b3c9ceb5669adebbcdadebf29494f67eb317ab6a34c345918898a3cb35bfc0f78999a45b237aeab417bb0510f4bb149cb55538f06bedd6535054d1185a2e88a396b3607938a0a5f525b445f3302a32602c3f81d6d856e321e5e1c7761ec07f45aa61c99c63648f00d543aeb801189257c49d5cd07de0ba5c4377d90fbbdba04fab1492fb35a59c772ab6c3e604ae9364b6061786f04d2c3cd0828a258d3b542069dcf19196e8df595ec56629ba7153371b36cf39937c466f85e3295e1e611e175b011da9004217830539980fc88c826d4197a5ee45cbe86660f7a49edd9331d304c23829f1b7219609c578556adb644c7d52824f3cb4e28f847fbba044b176263b32d56f9061b724c702f43d9610351863abff17908811208183fb4d57045a11ecc6c1eb6ead949b837c0e788d87628920f4922c1cdb6e5a88ccd884a2c5c62c4a47363a2e8c3b3f6f5efda037746336b20bb0965f5e2f6ae8fe5df9b7db01b65776c339e228c51cfbc27dbca1dad072b81a7fc93f4090c3d35536ea1e514f4959844fa156fe6fc14dd87755cbaebe6fe88453b8942037e04862f8dc9f011a07b0658308dcc74a004699ddc29e37ff125c2b452849f055684f45738b25f45fa44530141f30fab5b3f5a64ad241865eccdd180cb5b94615dbe867ffe7e550512a5e1e25ee9e237d72ad9bdecadfbce54757e367de81b6937d91f4b9c3720301cd845bcee7307fd8896881e8e07fd36248f4e71e41b562348c13fef0084612cee17ff4a7d468769f4498c37697a80a194acb4f69ae48c48652d7aeb6074baee021881cb5e81dad5a6b2c6c2ff3beab38f0ff09415c65d9c427cfefb0eda9a786170080c117213e19fd08d4e0e29eae49b4ce02e0f80d37ba5db59f9da36c62c25a0c5c75934419f4a88ee8763ba522fdf4ae8284bb8f2d41b0262ee0d18454425523490d8c593a156da48e663906d1613647423c5b5fbff92fe21e0ffc831d7d997425c7b89cc9012aabfdfd84a3c85c24419200920ffb47093bdeb5f6bdf1c609d17013326b45cd3092ac5df48688b507306595162bba605df537c16bf633dd5f144984feb7611ff242f81e7444c53a2cf45385625376ef5e6c81eff7518deacd4a02902e93dce549c5bbfec894c880008925e2fd9040ed004c4d62542ae9ed1e0cf3795b557a5a90184ff420d2affb6d740a5be2acf03cdeead81c64a534c17433c468e1be1d0e8b3ab41d570deebff9c30fa851af426e9b70f42247f6e8b0268b8ffe4fa591d34dc9b4081b2aceebf35eae88927ea2747d65577d19016b5f384bd4ccb347ba6cb11f13df2855e78af450d3df5cea88a50e6bf2881e040887c8bd0a7c2e7424dce4f25fcaa1d7638025b3e3fef6f92d8cd47fe2e80bd5f311a5b8813367906fcc94d1b33481956c61ae8e3528a752a33605a38b88fcf5a080756cb36e61ed65bab6e7d2fa5fa3f546397a6971ceff0cc95f37c683346894698f5d1872c65d092ad504a764317da04ac7d546b84974a9a8ddb1b5a3e418e5e2de1ebf1471211dc38a9c2b0842011021350174c20b01f8f7fc84d2136623e47d8fb942f19c5275899560c3c88c48177db65b52062e43e2a9127a2acc6369ccd03fee7ad400d84e86f76ef79bda5200337b75e52e47043be4aaec8fbb53ca0af074100496963fc90d90e9855b3bc44a6c4e319d21329d0be22c90d00178cfdc0e8b7521fb009af475add35cd516cc4dbd45cb9df289563e8282748ff32714a9bd9c8239873310edc61bbce61e8d3ec3f7b0383d4cc294e22fe2c3c284b8d5d7b184f78bc181e16800da9409b48fce56d6c7b7a91ece21d695acc4f7cf8d7d118eca5f32120e87f027755d354b36fcc4c8ab116dba72b1a41256b3ca9e122343aa2c37f889138f31ea4b8a0faa2a6cdded1333b3d5403b817bb8b25d870e75de6f358e8663796c11eb3af49346582b6e1171d33ea5551341d3e62750bb1a1a32d4c7c8fb8099fb392c7ede78e3512bf9dd5965d1687451b54ed334c14bc6b43f2e407eff3083b16ecc0cfad0a08e03b578648e7be733966ca7e878f5fa006085bea002aa7eef5f9b972cd0be271f678fc5d19b1d739a42f99ff6a20594dc0f8c7438d5c9dda81b297c5c368c9b1df6009d0c4b0acbf5e5956b2b733a0f2fe88e0c3394f4f0848cf1934f0692eadaa050cc1268c6e8ac0a86666ccd1c27c888462f93d233c792f2fecb87fc8fa996e10d4742be4e390b2c14d497583531212a0e6a813c54d54ae28e48e419e84c238e84e2386150afdbc6c5478dc7030cafdaed4359d6a215b2a5e648639bbcbd2af3cc07e9af00456286357122f187d7befc94ed7e9a45f5026e4e26d89d8b8228ca64faba1e8134f543a416de24725d0c371ec7fc187a428992153feafe3d035cd6d5742fb5410a428ca95b40df0e36d472813521b7700849b9100218ac41823217ee4c19f218d8b2d208ae0147ad1190dc37cfb44c6f2e5be8d9f0fefe4ddff6dc4307ea2e0400e1d40fc468dbe1d06528e684bd10d1a10bcef32654b0ce65c36a54cc4dc0c6378d806f1e241f181bbaa6beec413453d77390803449b9a222e406459bfb21c4bd1dc175713007efa6be40ae99d97c358159f8e220818d76b26ff521ce92be89276a2d12611ca69ea111fb3019e9b422e28143c79fdb978b92caf6b1b50b02e57037994b930d5b5b4a2a4c8296672bb10edd52adaace584cbed473b5400edc44c8b6b670a4daa32bada56c748132a297a4c4372def90edde9cb9da24320bafedba7e1b0dddf248854b892b460b02a628ca765477e45fe42556623283f318506cd52b8b8d062969675b9c64fca6050572b2c3fbfe778c8a3afe4d9ab9912585b4e3800127ad25c03a048425fa8376e95e97c240900ccf398c7fe41a915b03290815477876dbaf4aaadec64928f4dee83fa58719178bfee24627734a7c80776eb7fe2a7d3086e64f5e8e32707a8e71b50f7cd8474dc1b7bca30dacceddbad4e4483b66ef641da3cb8c96aafdf1555397bf0da46bc05177af91694162c75272b09cdeed07ba246ce7bf441b112645873eca78633654c38f9d04f23b2793d544b564cc2af2274502f3996de8e2de368c63b19fab350f54bec2ef5f2c3a5eacf29342636b897eabb6a3ea7e77a72d7e08adb5906064536169bf05b04f45332faa02fb8b40abd5aad5d7bbd442f720029d6e557f3369a26593b4eb9025f16fb6b4963a77f66802dcabfed747255c52a5a9afd83e75a54112ab62c396db59aa1a48c7e391146babe0ebcd7060f2655fc302833141ce678a8f87e0ccecf6a49532f6e7b0f2778fc728d39c03e703bb0a30dce68d03d7046e3f75241f455a757864ac85b5e140e81ba6ad999d083683439acbb685540a5a15b8ce72214000ffca3f2619cf3c9e1389f4708fcb4c10005f1886c688107f6d4bf3ee1f1aa35a60bd11675bfbe849e8a794db7f43c332d9c16d517a36cec51d22b8d279b609531aa170f5058b2bccbda61c0b4d63f15a6c5448611575d3b723294a333236b575296c2870ee1dfd39abf760ccc4f9300cc1db9a5b6b01d8edfe5693f31296904808372eeee2270c25a40e8d08cf62910c9a8292694c3b0eaf1447a3ca7a9b9111599e5e45875a46597373435b20ae4cb22164acc0618259f59c4ffbc50123d2a3866878137f585cdd4b6db3f8ff4c5951f35aaa38799a84fe760743a31e8a4171bd5c2fc681ca1d14feb193ffaf28a37b54f8ef5e0b1d8821e0f4dae03a198122d7de56b3d3cbdcdc7135c5037940f79929f4992765cf5645a5af78d6c6b74e869c80d6774eb4b29daff422433c9d5d13d4ef2ec676c8d42f97ba5f518e8ce0821094a64199b5adae392ac6745f1050f744600508a4032f878d1f2dcb9cb6b56421cec6f90de452eb61578631f28651c69b6ee3674b6681238e7f86fdc1b724579097104fb0373ccb053359979c707f73264eb3929071d23", 0x1000}, {&(0x7f00000002c0)="d4fe81e8edb6b477525bbbf96982dcffe47b4f903384ec796fc0b27cababce4ecf250e0ed91f5511eafcbfcd305db3725c380e576d9c38905d668ee8bb68fb0f168d48f625ac1aa1f3072e190fd0142a3328a55bfadd462f5df9ec03fb266115cf6b34603fd157f41a731ac31e3cdc1d098509b0be6729ae0e9f5258a345700cda5c06647ac2e5ceb80d86", 0x8b}, {&(0x7f0000000380)="cde7314dabdbaf990dd5dbd04429bb70bdf69566281f7c28c498ba48c5819cc3b3e67f8ee96b363d5ab605cd6fdbff7c3e1f938a5af1150b183962ed7e0913301818fad86e8d6b5b33a459d711e53c0276545a55c95e0b273acd64f5333a079d", 0x60}, {&(0x7f0000000400)="63184fa0e28fde89a867efc59fdce05c35d95d38a24a743c91dbc4e8fe740f3fab3e968fb2fa3a89a9b8f66c9b17803308e6a6e2c946748851a085166b21da1a1fb80edbf7d9fac89b194dac15c7f3a485a113d7f10f267e80d75042fc50cb9b0cb758c0cdd54035b6b8190b544a51d1dce1b77093c22a88d29e519b325a96c8da500083561c23fa3399ba1ce33b996e1bc333e825eeabe503251f2d5920af9bcf229c83af6c895652b6d56bced408", 0xaf}, {&(0x7f0000000580)="c3f7845c0a3ef7711679a689fcf187f05fd4ccb7b9796c20479fab1161e92027fb99b422c6f3418a3ca313d88e562899d484b555aaafbee3e2646d28a685664c57f734689a1945233bc03b459b88232a9b9b591a2734d18375338343a64d97312070a92cf4f8240242d2574b44264d3ae8d17fa29bff7cc3d43dbaf050c90b1694d8ab9f69cb67efe6ad82147a9f5c6d021099b87ce93ebab3befe6390b63691fe87e569def6cb0ee5fe004a616c6c8d99453cdd484f859dfa63928725ca1df5a40e7545289cf1b0219ce7542fcc216c153c5d0c32eb3a4f4afd69812abcd6e9291fd8680720ba00c917d05698d27c7230cf", 0xf2}], 0x8, &(0x7f00000000c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xa00}}], 0x18}, 0x20000000) 23:49:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:00 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x5aeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\xff', 0x200000000100017e, 0x0) write$cgroup_type(r0, 0x0, 0x0) [ 1463.954305] binder_alloc: 1779: binder_alloc_buf, no vma [ 1463.961233] binder: 1780:1788 got transaction with fd, -1, but target does not allow fds [ 1463.961282] binder: 1780:1788 transaction failed 29201/-1, size 72-24 line 3427 [ 1463.961550] binder: undelivered TRANSACTION_ERROR: 29201 [ 1463.986623] binder: 1780:1790 transaction failed 29189/-22, size 72-24 line 3138 [ 1463.987059] binder: undelivered TRANSACTION_ERROR: 29189 [ 1464.012623] binder: 1779:1786 transaction failed 29189/-3, size 112-24 line 3284 [ 1464.031043] binder: undelivered TRANSACTION_ERROR: 29189 23:49:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:03 executing program 4: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) connect$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @multicast1}, 0x10) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="020d030f390000002dbd7000fbdbdf2502001300080000002bbd70000000000010000800980300000300524006f2a4c71091672705d7e2b1a610465c046de2b6787ba7a11cf73241942faa6c5571473197d22a19b03488c96e511307a7c237134f7da41f0cc696a86b6e3b22fb857d30b91a61b873816f2547b38028384290664eb9d068059c8a5dda542c9cccbbb08d1b36dad61c3ec3d6f31aa40000000000070019000000000002004e23e000000200000000000000000a004e2400000001abf1cc05901b88a492a889650100008000000000000000000800120003000400bd6b6e001ced000006003200fc0400000180ffff00000000ff010000000000000000000000000001e00000020000000000000000000000000800120001000300b56b6e000500000006002b00e53400000100000000000000ac141425000000000000000000000000ac1414aa0000000000000000000000000800120001000100bb6b6e000700000006003c00c00700000300000000000000fe80000000000000000000000000001dfe8000000000000000000000000000bb040002000500000004000000000000000300000000000000000100000000000002000b00060000009e2b000000000000"], 0x1c8}}, 0x20040000) r4 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x40000000, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffffffffffffec8, 0x18, &(0x7f0000000000)={@flat=@weak_handle={0x77682a85, 0x1000, 0x3}, @fd, @fd={0x66642a85, 0x0, r4}}, &(0x7f0000000380)={0x0, 0x18, 0xfffffffffffffe3d}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'dummy0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@setlink={0x34, 0x13, 0x80d221ea7a3f36cd, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_VFINFO_LIST={0x14, 0x16, [{0x10, 0x1, [@IFLA_VF_SPOOFCHK={0xc}]}]}]}, 0x34}}, 0x0) 23:49:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0x0) munlockall() 23:49:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:03 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:03 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(r0, &(0x7f0000000180)='cgroup.controllers\x00', 0x2761, 0xfffffff5) 23:49:03 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000001800"/24]], 0x0, 0x0, &(0x7f0000000640)}) [ 1466.895035] binder_alloc: 1801: binder_alloc_buf, no vma [ 1466.901427] binder: 1801:1804 transaction failed 29189/-3, size 112-24 line 3284 [ 1466.925964] binder: undelivered TRANSACTION_ERROR: 29189 23:49:03 executing program 0: mknod(&(0x7f0000000080)='./bus\x00', 0x8, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) lsetxattr$security_capability(&(0x7f0000001340)='./bus\x00', &(0x7f0000001380)='security.capability\x00', &(0x7f0000001440)=@v2={0x2000000, [{0x3}]}, 0x14, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setreuid(r1, r1) execve(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) [ 1466.972424] binder_alloc: 1817: binder_alloc_buf, no vma [ 1466.986880] binder: 1817:1821 transaction failed 29189/-3, size 112-24 line 3284 [ 1466.998753] binder: 1824:1827 got transaction with fd, -1, but target does not allow fds [ 1466.998787] binder: 1824:1827 transaction failed 29201/-1, size 72-24 line 3427 23:49:03 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)=@random={'security.', '/dev/binder#\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xc04) [ 1466.998941] binder: undelivered TRANSACTION_ERROR: 29201 [ 1467.016322] binder: 1824:1829 transaction failed 29189/-22, size 72-24 line 3138 [ 1467.016549] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.049869] binder: undelivered TRANSACTION_ERROR: 29189 23:49:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1467.064996] binder: 1833:1836 got transaction with fd, -1, but target does not allow fds [ 1467.080947] binder: 1833:1836 transaction failed 29201/-1, size 72-24 line 3427 [ 1467.091414] binder: 1838:1840 transaction failed 29189/-22, size 112-24 line 3138 [ 1467.091630] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.116834] binder: undelivered TRANSACTION_ERROR: 29201 [ 1467.123187] binder: 1833:1836 got transaction with fd, -1, but target does not allow fds [ 1467.132427] binder: 1833:1836 transaction failed 29201/-1, size 72-24 line 3427 [ 1467.141507] binder: undelivered TRANSACTION_ERROR: 29201 23:49:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:06 executing program 0: writev(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x10000, 0x0) socket(0x10, 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000980)) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000cab000)) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000009c0)={{{@in=@dev, @in=@broadcast}}, {{@in=@broadcast}, 0x0, @in=@local}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4}, 0x3c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x28, &(0x7f0000000040)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r2}, 0xc) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000b00)={r2, 0xd3c}, 0xc) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) eventfd(0x2) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x4c00}}]}}) rt_sigsuspend(&(0x7f0000000340), 0x8) syz_emit_ethernet(0x66, &(0x7f0000015e15)={@broadcast, @local={[], 0xffffffffffffffff}, [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x3a, 0xffffffffffffffff, @remote, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x4]}, @mcast2}}}}}}}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) 23:49:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(r1, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) write$P9_RLCREATE(r2, &(0x7f00000000c0)={0x18, 0xf, 0x1, {{0x40, 0x1, 0x8}, 0x8}}, 0x18) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000008500000e00"/20, @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x200000000000004) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") writev(r0, &(0x7f0000000040)=[{&(0x7f0000000080)="480000001400191809604beafd0d8c562c8447000bffe0064e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) 23:49:06 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @random="8c1b9261ca19", [], {@ipv4={0x800, {{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @rand_addr=0xfffffff8, {[@timestamp={0x44, 0x4, 0x5}, @ssrr={0x89, 0x3}]}}, @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 23:49:06 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r6, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0xfffffffffffffdf6, &(0x7f0000000080)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:06 executing program 1: syz_open_procfs(0x0, &(0x7f00000000c0)='net/icmp\x00') 23:49:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)=@random={'security.', '/dev/binder#\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xc04) [ 1469.928414] binder: 1847:1854 transaction failed 29189/-22, size 112-24 line 3138 [ 1469.959195] binder: undelivered TRANSACTION_ERROR: 29189 23:49:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)=@random={'security.', '/dev/binder#\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xc04) [ 1470.001277] binder: 1869:1872 transaction failed 29189/-22, size 112-24 line 3138 [ 1470.013671] binder: undelivered TRANSACTION_ERROR: 29189 [ 1470.025169] binder_alloc: 1868: binder_alloc_buf, no vma [ 1470.025187] binder: 1868:1873 transaction failed 29189/-3, size 72--522 line 3284 [ 1470.041898] binder: undelivered TRANSACTION_ERROR: 29189 23:49:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) utime(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x400, 0x8}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x1, 0x0) write$FUSE_DIRENT(r2, &(0x7f0000000140)={0x98, 0x0, 0x6, [{0x5, 0x6, 0x0, 0x6}, {0x3, 0x100000000, 0xd, 0x14000000, '/dev/binder#\x00'}, {0x4, 0x3, 0xd, 0x100, '/dev/binder#\x00'}, {0x5, 0x5, 0x7, 0x7, 'bdev.)!'}]}, 0x98) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_handle={0x77682a85, 0x1194, 0x2}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r3}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}, 0x12c0}], 0x15c, 0x0, &(0x7f0000000300)="961377f5b0a265c2f14fdc784adaa87f689fa842ed1bc0335a65bb66d0c0efd872ce7b628847ce97d2010000008a818a5a59c0ab2d112c0d8f82bb575bc0d9054329dc3c05ac9d07098a9d540ae6d42ef2cc66f671a8851471baa3a8a31eabc91c899baf9cfd706cb77d06aa198b137cfef24731b2fd7efbe3636b304d0e8285b97d4a9b7825a0d7cd516e0c36ad5ff5a9a3c79d98d15efdd19fdba92a34a0a7703eed0349c11a4ee213bed76e1244c7b3da2f27ad2eae9721a16b726cea100d680d838393a24af97005425f47c78db08da40cf0bbe521ec2995504bfac5919121ce57ae66221f5a03ccd3d07965f89890da587e4c1d0f3c8ed9d13599774a225f5dee0b9d92e7a641eeed26f72a41265d8cb058aec2df2a3a70e0072b6535e1bd0386ba825c6b865d966bb8514e59898ae0cd9f132570ca8c4f8b463dfbf6d036a143596781b197402a22e9853d98e23def6279ccdc160d0b88484f"}) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000000)) 23:49:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)=@random={'security.', '/dev/binder#\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xc04) 23:49:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1472.952341] binder_alloc: 1882: binder_alloc_buf, no vma [ 1472.952355] binder: 1887:1888 got transaction to invalid handle [ 1472.952363] binder: 1887:1888 transaction failed 29201/-22, size 72-24 line 3138 [ 1472.973257] binder: 1887:1900 got transaction to invalid handle [ 1472.973268] binder: 1887:1900 transaction failed 29201/-22, size 72-24 line 3138 23:49:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x1, 0x4]}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x81}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x18, r5, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ptrace$setregset(0x4205, r1, 0x4, &(0x7f0000000080)={&(0x7f0000000140)="3a3504105ceafde1306cebea506209332bb2f503f15b6fa09d3e8ae006de87ce0e6e84aa95487fa97dd71e755048902f430be30314d9d3ffe59f72feed42034c3bab92c7e5cae747f2a5df8d19a342bb40aba05a5f336bffb46fc6c6cf5fd09f3fd1893e924be6ccc0369837b6259f2ba5e7ed069e88791f484d67a738c1486b10f84e358f8e8c3f21c003d4dfb172d88aef4cee7fbc7b6a8d62461325d0ff422cb9ca97cee06e6858506dc6265e331d5052a27df4e019eb08a973769bc4e5d19d7dd1724ecf9999883071622e3a0ffe9cc25ff060ebca7c8f76cca17410", 0xde}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000001800000000000000300000fbcc00005e"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:09 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x1, 0x4]}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x81}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x18, r5, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1473.005685] binder: 1882:1885 transaction failed 29189/-3, size 112-24 line 3284 [ 1473.038627] binder: undelivered TRANSACTION_ERROR: 29189 [ 1473.071249] binder: 1915:1917 got transaction with too large buffer [ 1473.078765] binder: 1915:1917 transaction failed 29201/-22, size 112-24 line 3493 [ 1473.090129] binder: undelivered TRANSACTION_ERROR: 29201 23:49:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x1, 0x4]}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x81}, @SEG6_ATTR_DSTLEN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x18, r5, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000004}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 23:49:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3a7, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@binder={0x73622a85, 0x0, 0x40000000}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 23:49:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = socket(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='B3\x02\x0fv2\x00') getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300400000ff8dc3b0b1992623a02e942a7880c8258bfbb3842979088d7fe134455c1e8e45625205304410bb96ca08ddd01004dd1c1cde925561d99faf3e302f2ee0b27323ad2fbf0d31086dd5f52836e72aaced47b97d0c2ff77e441f11851922e4aa4f2f1369cda928e0e", @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x44}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x218, r4, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xd0, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1784}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0db}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x110, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x47}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b04bac5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x11ec}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x39e5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfaea}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4dca}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}]}]}, 0x218}, 0x1, 0x0, 0x0, 0x20}, 0x5a409f083629f97c) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$RTC_IRQP_SET(r6, 0x4008700c, 0xe42) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r8, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r7, 0x2405, r8) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r10, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r10) sendfile(r8, r9, &(0x7f00000001c0)=0x2a11, 0x8) [ 1475.968391] binder: 1921:1923 ioctl c0306201 0 returned -14 [ 1475.979420] binder: 1924:1925 got transaction with fd, -1, but target does not allow fds [ 1475.982919] binder: release 1920:1928 transaction 1174 out, still active [ 1475.982924] binder: undelivered TRANSACTION_COMPLETE [ 1475.987526] binder: send failed reply for transaction 1174, target dead 23:49:12 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1476.015560] binder: 1924:1925 transaction failed 29201/-1, size 72-24 line 3427 [ 1476.030105] binder: undelivered TRANSACTION_ERROR: 29201 [ 1476.036840] binder: 1931:1936 ioctl c0306201 0 returned -14 23:49:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = socket(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='B3\x02\x0fv2\x00') getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300400000ff8dc3b0b1992623a02e942a7880c8258bfbb3842979088d7fe134455c1e8e45625205304410bb96ca08ddd01004dd1c1cde925561d99faf3e302f2ee0b27323ad2fbf0d31086dd5f52836e72aaced47b97d0c2ff77e441f11851922e4aa4f2f1369cda928e0e", @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x44}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x218, r4, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xd0, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1784}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0db}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x110, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x47}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b04bac5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x11ec}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x39e5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfaea}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4dca}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}]}]}, 0x218}, 0x1, 0x0, 0x0, 0x20}, 0x5a409f083629f97c) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$RTC_IRQP_SET(r6, 0x4008700c, 0xe42) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r8, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r7, 0x2405, r8) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r10, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r10) sendfile(r8, r9, &(0x7f00000001c0)=0x2a11, 0x8) 23:49:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = dup(r1) mmap$perf(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x4bb759488913ef13, r2, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) write$P9_RAUTH(r2, &(0x7f00000000c0)={0x14, 0x67, 0x1, {0x49, 0x0, 0x4}}, 0x14) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000080)=0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1476.041037] binder: release 1929:1933 transaction 1177 out, still active [ 1476.041041] binder: undelivered TRANSACTION_COMPLETE [ 1476.047826] binder: send failed reply for transaction 1177, target dead [ 1476.091658] binder: release 1943:1944 transaction 1180 out, still active 23:49:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = socket(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='B3\x02\x0fv2\x00') getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300400000ff8dc3b0b1992623a02e942a7880c8258bfbb3842979088d7fe134455c1e8e45625205304410bb96ca08ddd01004dd1c1cde925561d99faf3e302f2ee0b27323ad2fbf0d31086dd5f52836e72aaced47b97d0c2ff77e441f11851922e4aa4f2f1369cda928e0e", @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x44}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x218, r4, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xd0, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1784}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0db}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x110, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x47}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b04bac5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x11ec}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x39e5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfaea}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4dca}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}]}]}, 0x218}, 0x1, 0x0, 0x0, 0x20}, 0x5a409f083629f97c) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$RTC_IRQP_SET(r6, 0x4008700c, 0xe42) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r8, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r7, 0x2405, r8) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r10, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r10) sendfile(r8, r9, &(0x7f00000001c0)=0x2a11, 0x8) 23:49:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1476.111628] binder: undelivered TRANSACTION_COMPLETE [ 1476.122667] binder: 1950:1952 got transaction with fd, -1, but target does not allow fds [ 1476.122703] binder: 1950:1952 transaction failed 29201/-1, size 72-24 line 3427 [ 1476.135303] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.135312] binder: 1951:1953 ioctl 40046207 0 returned -16 [ 1476.135790] binder: 1951:1953 ioctl c0306201 0 returned -14 [ 1476.138872] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.138882] binder: 1950:1952 ioctl 40046207 0 returned -16 [ 1476.141379] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.141387] binder: 1956:1958 ioctl 40046207 0 returned -16 [ 1476.141929] binder_alloc: 1943: binder_alloc_buf, no vma [ 1476.141949] binder: 1956:1958 transaction failed 29189/-3, size 112-24 line 3284 [ 1476.157406] binder_alloc: 1950: binder_alloc_buf, no vma [ 1476.157426] binder: 1950:1954 transaction failed 29189/-3, size 72-24 line 3284 [ 1476.227846] binder: undelivered TRANSACTION_ERROR: 29189 [ 1476.233303] binder: undelivered TRANSACTION_ERROR: 29189 [ 1476.240396] binder: undelivered TRANSACTION_ERROR: 29201 [ 1476.246109] binder: send failed reply for transaction 1180, target dead 23:49:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 23:49:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x400) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000000)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x32, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@flat, @fd, @fda={0x66646185, 0x2, 0x1, 0x28}}, 0xfffffffffffffffe}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = socket(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='B3\x02\x0fv2\x00') getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="300400000ff8dc3b0b1992623a02e942a7880c8258bfbb3842979088d7fe134455c1e8e45625205304410bb96ca08ddd01004dd1c1cde925561d99faf3e302f2ee0b27323ad2fbf0d31086dd5f52836e72aaced47b97d0c2ff77e441f11851922e4aa4f2f1369cda928e0e", @ANYRES16=r4, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x44}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x218, r4, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0xd0, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1784}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0db}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x110, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x47}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b04bac5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x11ec}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x39e5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfaea}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4dca}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}]}]}, 0x218}, 0x1, 0x0, 0x0, 0x20}, 0x5a409f083629f97c) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$RTC_IRQP_SET(r6, 0x4008700c, 0xe42) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r8, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r7, 0x2405, r8) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r10, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r10) sendfile(r8, r9, &(0x7f00000001c0)=0x2a11, 0x8) 23:49:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1479.004844] binder: 1967:1970 got transaction with fd, -1, but target does not allow fds [ 1479.017884] binder: 1967:1970 transaction failed 29201/-1, size 72-24 line 3427 [ 1479.020278] binder: 1961:1971 got transaction with invalid offsets ptr [ 1479.020304] binder: 1961:1971 transaction failed 29201/-14, size 72-24 line 3330 [ 1479.020694] binder: undelivered TRANSACTION_ERROR: 29201 23:49:15 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 23:49:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x400) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000000)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x32, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@flat, @fd, @fda={0x66646185, 0x2, 0x1, 0x28}}, 0xfffffffffffffffe}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0)='devlink\x00') r7 = getpgrp(0xffffffffffffffff) r8 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00022dbd7000ffdbdf2525000000100401006e657464657673696d000000100002006e659564657673696d30000008008a00", @ANYRES32=r7, @ANYBLOB="100001006e657464657673696d000000100002006e657464657673696d30000008008a00", @ANYRES32=r8], 0x64}, 0x1, 0x0, 0x0, 0x84}, 0x400) ptrace$cont(0x3f, r8, 0x6, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x400) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000000)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x32, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@flat, @fd, @fda={0x66646185, 0x2, 0x1, 0x28}}, 0xfffffffffffffffe}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1479.049437] binder: undelivered TRANSACTION_ERROR: 29201 [ 1479.056677] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.056686] binder: 1967:1970 ioctl 40046207 0 returned -16 [ 1479.098242] binder: 1980:1985 got transaction with invalid offsets ptr [ 1479.098267] binder: 1980:1985 transaction failed 29201/-14, size 72-24 line 3330 [ 1479.114042] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.114051] binder: 1984:1987 ioctl 40046207 0 returned -16 [ 1479.114158] binder_alloc: 1967: binder_alloc_buf, no vma [ 1479.114177] binder: 1984:1987 transaction failed 29189/-3, size 72-24 line 3284 [ 1479.140483] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.140497] binder: 1992:1993 ioctl 40046207 0 returned -16 [ 1479.140871] binder_alloc: 1980: binder_alloc_buf, no vma [ 1479.140890] binder: 1992:1993 transaction failed 29189/-3, size 72-24 line 3284 [ 1479.199053] binder: undelivered TRANSACTION_ERROR: 29189 [ 1479.205340] binder: undelivered TRANSACTION_ERROR: 29189 [ 1479.210916] binder: undelivered TRANSACTION_ERROR: 29201 23:49:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x804) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0xffffffffffffff70, 0x0, &(0x7f0000000500), 0x25a, 0x0, &(0x7f0000000140)="685385d31037c4f9f3fa2b7835644bf987ac2c8b8c22b477d8984f042b267425b910cf222575b6c266a86906bb8fbdccda3ac8e033166f92791bfb471a126f3e486981ea3d6914fdb29212c76981643c0d0c4a234468b03b7107f08ac39fcc65c95b43598db348b60cd9"}) 23:49:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 23:49:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:18 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 23:49:18 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:18 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) 23:49:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:49:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f0000000080)) 23:49:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@initdev, @in=@broadcast}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000080)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000000200)=""/123, &(0x7f0000000280)=0x7b) 23:49:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@initdev, @in=@broadcast}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000080)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000000200)=""/123, &(0x7f0000000280)=0x7b) 23:49:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:49:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x19, &(0x7f0000000180)={@empty, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000003c0)={@ipv4={[], [], @empty}, @empty, @empty, 0x6, 0xcbb, 0x2, 0x180, 0x5, 0x2800040, r4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:49:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@initdev, @in=@broadcast}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000080)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000000200)=""/123, &(0x7f0000000280)=0x7b) [ 1482.087448] binder: 2010:2018 got transaction with fd, -1, but target does not allow fds [ 1482.103056] binder: 2010:2018 transaction failed 29201/-1, size 72-24 line 3427 [ 1482.114754] binder: undelivered TRANSACTION_ERROR: 29201 [ 1482.140358] binder: 2025:2030 got transaction with fd, -1, but target does not allow fds [ 1482.149648] binder: 2025:2030 transaction failed 29201/-1, size 72-24 line 3427 [ 1482.170451] binder: undelivered TRANSACTION_ERROR: 29201 23:49:21 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockname(r3, &(0x7f0000001800)=@nfc, &(0x7f0000001880)=0x80) keyctl$chown(0x4, r2, 0x0, 0x0) r4 = request_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000140)='vboxnet1mime_type$\x00', 0xfffffffffffffffa) r5 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_THREAD_EXIT(r7, 0x40046208, 0x0) keyctl$chown(0x4, r5, 0x0, 0x0) r8 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r9, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r8, 0x2405, r9) getsockopt$inet_int(r7, 0x0, 0x14, &(0x7f0000000680), &(0x7f00000017c0)=0x4) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r10, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r10, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r10, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000640)={0x9c, 0x0, &(0x7f0000000580)=[@dead_binder_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000380)={@flat=@weak_binder={0x77622a85, 0x1000, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000700)=""/4096, 0x1000, 0x1, 0xc}, @flat=@binder={0x73622a85, 0x3}}, &(0x7f0000000400)={0x0, 0x18, 0x40}}}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r8}, @fda={0x66646185, 0x5, 0x1, 0x40}, @fd={0x66642a85, 0x0, r10}}, &(0x7f00000004c0)={0x0, 0x18, 0x38}}}], 0xb8, 0x0, &(0x7f0000001700)="f755a7d612ad7a308e8202f9ee6389a9651883e90ab026a9b12238d5cd79092413fea0df4f807e6b304f6ad7596faeea7fd28c3027818acf2bc6c4a570855e69d3dfe06103c0c6e64c6533bd31116d3a36a36e617e048ae9cd34d2ae954944717a85a206d8e49517da8acb07a1ed0db1245b3f81045a63a924642bee6e6c825c5dc76f61cb34e38394d72b8db41c0f53b28cecc6934a69c3161b43092816dc124b3aba0d7dd04579a258242d3aaa1d13ca8e624acb278424"}) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r4, r5}, &(0x7f00000001c0)=""/136, 0x88, &(0x7f0000000300)={&(0x7f0000000280)={'streebog256-generic\x00'}, &(0x7f00000002c0)="970323e5292b599de02966976a08", 0xe}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="00634040008000000000000000000000004070cadfc2eb82be8e47419500000000000000385000"/51, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) 23:49:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x19, &(0x7f0000000180)={@empty, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000003c0)={@ipv4={[], [], @empty}, @empty, @empty, 0x6, 0xcbb, 0x2, 0x180, 0x5, 0x2800040, r4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000065fd000000850a659018d2e7dac749d08e7c8d60a7c7463b53138c0a3537f383adeb4fb8699ad7b02991eb89cb215cc3c36f1c18a3bba21f603caf1c8bd23abd6aa8424dea5f3400de764946efc7dfcdc5f52535e5", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x10, 0x0, &(0x7f0000000080)="81871ba02b369c63b257f5177d4a1bfd"}) 23:49:21 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x19, &(0x7f0000000180)={@empty, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000003c0)={@ipv4={[], [], @empty}, @empty, @empty, 0x6, 0xcbb, 0x2, 0x180, 0x5, 0x2800040, r4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:21 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000200)={&(0x7f0000000140)=""/134, 0x86}) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/load\x00', 0x2, 0x0) ftruncate(0xffffffffffffffff, 0x8080) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r5 = open(&(0x7f0000000240)='./file0\x00', 0x700000, 0x1) ioctl$RTC_EPOCH_READ(r5, 0x8008700d, &(0x7f0000000280)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x19, &(0x7f0000000180)={@empty}, &(0x7f0000000380)=0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1485.101640] binder: 2051:2053 got transaction with fd, -1, but target does not allow fds [ 1485.103834] binder: 2050:2055 got transaction with fd, -1, but target does not allow fds [ 1485.103871] binder: 2050:2055 transaction failed 29201/-1, size 72-24 line 3427 [ 1485.104186] binder: undelivered TRANSACTION_ERROR: 29201 23:49:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) [ 1485.112629] binder: 2048:2056 got transaction with invalid offset (0, min 0 max 0) or object. [ 1485.112660] binder: 2048:2056 transaction failed 29201/-22, size 0-24 line 3379 [ 1485.112819] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.138859] binder: 2060:2061 got transaction with fd, -1, but target does not allow fds [ 1485.138900] binder: 2060:2061 transaction failed 29201/-1, size 72-24 line 3427 [ 1485.139524] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.159062] binder: 2059:2065 got transaction with invalid offset (0, min 0 max 0) or object. [ 1485.159089] binder: 2059:2065 transaction failed 29201/-22, size 0-24 line 3379 [ 1485.159320] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.173913] binder: 2064:2067 got transaction with fd, -1, but target does not allow fds [ 1485.174193] binder: 2064:2067 transaction failed 29201/-1, size 72-24 line 3427 [ 1485.174597] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.190069] binder: 2068:2069 got transaction with invalid offset (0, min 0 max 0) or object. [ 1485.190096] binder: 2068:2069 transaction failed 29201/-22, size 0-24 line 3379 [ 1485.190376] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.282964] binder: 2051:2053 transaction failed 29201/-1, size 72-24 line 3427 [ 1485.292958] binder: undelivered TRANSACTION_ERROR: 29201 [ 1485.300016] binder: 2051:2070 got transaction with fd, -1, but target does not allow fds [ 1485.308902] binder: 2051:2070 transaction failed 29201/-1, size 72-24 line 3427 [ 1485.321393] binder: undelivered TRANSACTION_ERROR: 29201 23:49:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) 23:49:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x84, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) [ 1488.047618] binder: 2072:2075 got transaction with fd, -1, but target does not allow fds [ 1488.049412] binder: 2074:2078 got transaction with out-of-order buffer fixup [ 1488.049440] binder: 2074:2078 transaction failed 29201/-22, size 112-24 line 3467 23:49:24 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000140)={'broute\x00', 0x0, 0x3, 0x1000, [], 0x6, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000700)=""/4096}, &(0x7f00000001c0)=0x78) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000001300)}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x800000, &(0x7f0000000440)={[{@mode={'mode', 0x3d, 0x5}}], [{@dont_appraise='dont_appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '$'}}, {@subj_type={'subj_type', 0x3d, 'V'}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1488.049665] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.059162] binder: 2076:2080 got transaction to invalid handle [ 1488.059172] binder: 2076:2080 transaction failed 29201/-22, size 72-24 line 3138 [ 1488.059351] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.060290] binder: 2076:2082 got transaction to invalid handle [ 1488.060298] binder: 2076:2082 transaction failed 29201/-22, size 72-24 line 3138 [ 1488.060512] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.149129] binder: 2087:2089 got transaction with fd, -1, but target does not allow fds [ 1488.149176] binder: 2087:2089 transaction failed 29201/-1, size 72-24 line 3427 [ 1488.150555] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.156782] binder: 2094:2096 got transaction with out-of-order buffer fixup [ 1488.156813] binder: 2094:2096 transaction failed 29201/-22, size 112-24 line 3467 [ 1488.157080] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.234611] binder: 2072:2075 transaction failed 29201/-1, size 72-24 line 3427 23:49:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x0, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/\x03\x12\x00', 0x0, 0x2) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180)=0x100) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) readahead(r1, 0x9, 0xfffffffffffffff7) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000140)=0x3, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x35, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="400000000000000100ffffffba06e14a1b0e4a4d", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x84, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1488.244665] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.278451] binder: 2118:2125 got transaction with out-of-order buffer fixup [ 1488.294124] binder: 2118:2125 transaction failed 29201/-22, size 112-24 line 3467 [ 1488.294587] binder: 2124:2128 got transaction with fd, -1, but target does not allow fds [ 1488.294623] binder: 2124:2128 transaction failed 29201/-1, size 72-24 line 3427 [ 1488.295016] binder: undelivered TRANSACTION_ERROR: 29201 [ 1488.325907] binder: undelivered TRANSACTION_ERROR: 29201 23:49:27 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x84, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$uinput_user_dev(r7, &(0x7f0000000700)={'syz1\x00', {0x3, 0x0, 0x1, 0x7fff}, 0xc, [0x4800000, 0x4, 0x4000000, 0x8, 0x7f, 0x8, 0x2, 0x5, 0xfffffffe, 0xffffffff, 0x2, 0x100, 0x2, 0x18000, 0x2, 0x544a, 0x7, 0xf82, 0x5, 0x8, 0x3, 0x3, 0x1f, 0x7, 0x3, 0x7, 0x7ff, 0x100, 0xeb, 0x8, 0x4, 0x1000, 0x2, 0xffff, 0x4ba6, 0x80000001, 0x3, 0x1, 0x2, 0x3, 0x6276, 0x3ff, 0xfff, 0x4b6, 0xffffffc0, 0x2, 0x7, 0x2, 0xbdad, 0x101, 0x1, 0x66e21b09, 0xfffffffd, 0x6, 0x3, 0x9, 0x83, 0xe060, 0x7, 0x5f, 0x7, 0x3ff, 0x8000, 0x1ff], [0x3, 0x7, 0x0, 0x8, 0x8001, 0xce4, 0x401, 0x0, 0x1, 0x3ff, 0x5, 0x18080000, 0x6, 0xc60, 0x4, 0x2, 0x1000, 0x7, 0x80, 0xffffffbc, 0x1ff, 0x8, 0x1, 0x1, 0xffffff02, 0x1, 0x76410d89, 0x6, 0xfffffffb, 0x1, 0xfff, 0x2, 0xdfab, 0x0, 0x7, 0x37f85c63, 0x8, 0x400, 0x2, 0x4, 0x5, 0x7509, 0x6, 0x5, 0x800, 0x100, 0xcc9, 0x6, 0x7626, 0x1, 0x96000, 0xa8a, 0x7, 0x79, 0x33c, 0x6, 0x81, 0x7, 0x1, 0xfffffffe, 0x6, 0x1, 0x2, 0x2], [0xa6, 0x4, 0x24, 0xfff, 0x1, 0x6, 0x0, 0x65, 0xf6, 0x4, 0x10000, 0x9, 0x3, 0x7, 0x1, 0x2, 0x9, 0x0, 0x4, 0x8000, 0x9, 0x5, 0x5, 0x7, 0x65, 0x1f, 0x3, 0x1, 0x40000000, 0x1, 0x80, 0x2, 0x4, 0x5, 0x194, 0xfffffffc, 0x101, 0x8, 0xfffffff7, 0x5f, 0x7, 0x5, 0x6, 0x1ebd, 0x4, 0x2, 0x4, 0x3, 0x8, 0x0, 0x7, 0x1, 0x8, 0x101, 0x8000, 0x1, 0x1, 0x80, 0x1ff, 0x1, 0x1, 0xb2, 0x81, 0x6], [0x7, 0x9, 0x4, 0x8, 0x200, 0x7, 0x3, 0xf575, 0x4, 0x40, 0x6, 0x4, 0x7, 0x17b, 0x400, 0x7, 0x9, 0x7, 0xcf23, 0x10001, 0xdf0d, 0x80000000, 0xb5, 0x7, 0x100, 0x0, 0x160b, 0x0, 0x1, 0x8000, 0x8, 0x8, 0x198c80, 0x7, 0x9, 0x7, 0x1, 0x9, 0x0, 0x1, 0xfffffffc, 0x4, 0xf9, 0x80000001, 0x26, 0xfffffffd, 0x8, 0xc8, 0x3, 0x101, 0x40, 0xfffff800, 0x1f, 0x4, 0x3, 0x5, 0x3, 0x9, 0x7fffffff, 0x9, 0xffffffff, 0x1f, 0x9, 0x1]}, 0x45c) getpeername$packet(r5, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f0000000140)={r8, 0x1, 0x6, @broadcast}, 0x10) 23:49:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat, @fd, @fd}, &(0x7f0000000100)={0x84, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1491.146320] binder: release 2133:2136 transaction 1264 out, still active [ 1491.153237] binder: undelivered TRANSACTION_COMPLETE [ 1491.154883] binder: 2131:2138 got transaction with fd, -1, but target does not allow fds [ 1491.155294] binder: 2131:2138 transaction failed 29201/-1, size 72-24 line 3427 [ 1491.175931] binder: 2132:2137 got transaction with fd, -1, but target does not allow fds [ 1491.175971] binder: 2132:2137 transaction failed 29201/-1, size 72-24 line 3427 [ 1491.190785] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.190792] binder: 2142:2143 ioctl 40046207 0 returned -16 [ 1491.191402] binder_alloc: 2133: binder_alloc_buf, no vma 23:49:27 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000480a1843c70000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1491.191422] binder: 2142:2143 transaction failed 29189/-3, size 112-24 line 3284 [ 1491.207273] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.207281] binder: 2146:2148 ioctl 40046207 0 returned -16 [ 1491.208094] binder_alloc: 2132: binder_alloc_buf, no vma [ 1491.208114] binder: 2146:2148 transaction failed 29189/-3, size 72-24 line 3284 [ 1491.277529] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.277536] binder: 2149:2153 ioctl 40046207 0 returned -16 [ 1491.278050] binder_alloc: 2133: binder_alloc_buf, no vma [ 1491.278068] binder: 2149:2153 transaction failed 29189/-3, size 112-24 line 3284 [ 1491.281536] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.281545] binder: 2151:2152 ioctl 40046207 0 returned -16 [ 1491.281697] binder_alloc: 2131: binder_alloc_buf, no vma [ 1491.281717] binder: 2151:2152 transaction failed 29189/-3, size 855824140872-24 line 3284 [ 1491.343665] binder: undelivered TRANSACTION_ERROR: 29189 [ 1491.349136] binder: undelivered TRANSACTION_ERROR: 29189 [ 1491.354738] binder: undelivered TRANSACTION_ERROR: 29189 [ 1491.360237] binder: undelivered TRANSACTION_ERROR: 29189 [ 1491.365853] binder: undelivered TRANSACTION_ERROR: 29201 [ 1491.371485] binder: undelivered TRANSACTION_ERROR: 29201 [ 1491.377035] binder: send failed reply for transaction 1264, target dead 23:49:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="006340400000000000325774160000000000000000009d254879aad13d6d40a1000000000048000000f117000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1494.166348] binder_alloc: 2159: binder_alloc_buf size 6738906766657536 failed, no address space [ 1494.172151] binder: 2160:2168 got transaction with fd, -1, but target does not allow fds [ 1494.172184] binder: 2160:2168 transaction failed 29201/-1, size 72-24 line 3427 [ 1494.172349] binder: undelivered TRANSACTION_ERROR: 29201 [ 1494.176242] binder: release 2161:2165 transaction 1284 out, still active [ 1494.176246] binder: undelivered TRANSACTION_COMPLETE [ 1494.179957] binder: send failed reply for transaction 1284, target dead [ 1494.207447] binder: release 2171:2173 transaction 1286 out, still active [ 1494.207479] binder: undelivered TRANSACTION_COMPLETE [ 1494.217755] binder: send failed reply for transaction 1286, target dead [ 1494.224877] binder: 2175:2177 got transaction with fd, -1, but target does not allow fds 23:49:30 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1494.224910] binder: 2175:2177 transaction failed 29201/-1, size 72-24 line 3427 [ 1494.225411] binder: undelivered TRANSACTION_ERROR: 29201 [ 1494.277820] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1494.289406] binder: 2159:2163 transaction failed 29201/-28, size 6738906766657536-0 line 3284 [ 1494.301483] binder: 2182:2184 got transaction with fd, -1, but target does not allow fds [ 1494.302619] binder: undelivered TRANSACTION_ERROR: 29201 23:49:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1494.304331] binder: release 2179:2181 transaction 1292 out, still active [ 1494.304335] binder: undelivered TRANSACTION_COMPLETE [ 1494.316782] binder: send failed reply for transaction 1292, target dead [ 1494.327928] binder: 2159:2185 transaction failed 29189/-22, size 6738906766657536-0 line 3138 [ 1494.328169] binder: undelivered TRANSACTION_ERROR: 29189 [ 1494.351042] binder: 2182:2184 transaction failed 29201/-1, size 72-24 line 3427 [ 1494.371374] binder: undelivered TRANSACTION_ERROR: 29201 [ 1494.374416] binder: 2192:2194 got transaction with fd, -1, but target does not allow fds [ 1494.374451] binder: 2192:2194 transaction failed 29201/-1, size 72-24 line 3427 [ 1494.376096] binder: BINDER_SET_CONTEXT_MGR already set [ 1494.376103] binder: 2192:2194 ioctl 40046207 0 returned -16 [ 1494.386244] binder: 2191:2193 not enough space to store 0 fds in buffer [ 1494.386270] binder: 2191:2193 transaction failed 29201/-22, size 112-24 line 3475 [ 1494.434329] binder: undelivered TRANSACTION_ERROR: 29201 [ 1494.439935] binder: undelivered TRANSACTION_ERROR: 29201 23:49:33 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:33 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1497.177223] binder: release 2199:2202 transaction 1305 out, still active [ 1497.187582] binder: undelivered TRANSACTION_COMPLETE [ 1497.196636] binder: 2198:2205 got transaction with fd, -1, but target does not allow fds 23:49:33 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:33 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000140)={0x3, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x141002, 0x0) ioctl$KDGKBTYPE(r5, 0x4b33, &(0x7f00000000c0)) 23:49:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000008000000000000000000000700000000000000000000008561646600000000000000000000000001000000000000000000000048b744d426bd73fa5e2c1d843e2a2f4d6f41db595f870584e114c0a6766c2fbd825da3a57a661a329c08ef757366aecc056e4a55b01d21c9b9fda20045ae2023dee0222de39caaf78e19c4eea3bb1b0bdb79525e0c447b207ade3e1dd2141437686f7fb189a9fb6d7619f40dd21d8d9b9684ef7604aaab3b104448f629d80000000053ea85690e40"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x22a100, 0x0) write$P9_RRENAMEAT(r2, &(0x7f0000000100)={0x7, 0x4b, 0x1}, 0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x41c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000140)={@empty, 0x6, 0x7, 0x3, 0xe, 0x2b, 0x6}, 0x20) [ 1497.196673] binder: 2198:2205 transaction failed 29201/-1, size 72-24 line 3427 [ 1497.201106] binder: 2201:2204 got transaction with fd, -1, but target does not allow fds [ 1497.201139] binder: 2201:2204 transaction failed 29201/-1, size 72-24 line 3427 [ 1497.247574] binder: send failed reply for transaction 1305, target dead [ 1497.254535] binder: undelivered TRANSACTION_ERROR: 29201 [ 1497.260123] binder: undelivered TRANSACTION_ERROR: 29201 23:49:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1497.319417] binder: 2216:2218 got transaction with too large buffer [ 1497.326312] binder: 2216:2218 transaction failed 29201/-22, size 112-24 line 3493 [ 1497.331851] binder: 2215:2217 got transaction with fd, -1, but target does not allow fds [ 1497.331886] binder: 2215:2217 transaction failed 29201/-1, size 72-24 line 3427 [ 1497.332164] binder: undelivered TRANSACTION_ERROR: 29201 [ 1497.359375] binder: 2210:2213 got transaction with invalid handle, 3 [ 1497.359403] binder: 2210:2213 transaction failed 29201/-22, size 72-24 line 3411 [ 1497.361625] binder: undelivered TRANSACTION_ERROR: 29201 [ 1497.376231] binder: 2223:2225 got transaction with fd, -1, but target does not allow fds [ 1497.376267] binder: 2223:2225 transaction failed 29201/-1, size 72-24 line 3427 [ 1497.376606] binder: undelivered TRANSACTION_ERROR: 29201 [ 1497.419849] binder: undelivered TRANSACTION_ERROR: 29201 [ 1497.420710] binder: BINDER_SET_CONTEXT_MGR already set [ 1497.420720] binder: 2216:2224 ioctl 40046207 0 returned -16 23:49:36 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000140)={0x3, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x141002, 0x0) ioctl$KDGKBTYPE(r5, 0x4b33, &(0x7f00000000c0)) 23:49:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xdad7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r4, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x22, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES32=r3, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYRESHEX=r4, @ANYRES32=r0], 0x0, 0x0, 0x0}) [ 1500.211465] binder: 2230:2234 got transaction with fd, -1, but target does not allow fds [ 1500.218237] binder: 2229:2236 ioctl c0046209 0 returned -22 [ 1500.246734] binder: 2231:2235 got transaction with invalid handle, 3 [ 1500.246762] binder: 2231:2235 transaction failed 29201/-22, size 72-24 line 3411 23:49:36 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@exit_looper], 0x38, 0x0, &(0x7f0000000100)="decb07e23cd99d8bcd7e411b1ed1281f1887b877199eadc16df1d9d7c3a155bd98e0893a291771eca12b57a443da2de62bf3257a376b250f"}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000000c0)={0x1, 0x0, 0x97e7, 0x7}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x28d53d5abd1eb875, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x5, 0x0, 0x8}}, &(0x7f0000001300)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 23:49:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000140)={0x3, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x141002, 0x0) ioctl$KDGKBTYPE(r5, 0x4b33, &(0x7f00000000c0)) 23:49:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1500.248528] binder: undelivered TRANSACTION_ERROR: 29201 [ 1500.269434] binder: 2230:2234 transaction failed 29201/-1, size 72-24 line 3427 [ 1500.280015] binder: undelivered TRANSACTION_ERROR: 29201 23:49:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="7d2a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000002e11", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$RNDGETENTCNT(r3, 0x80045200, &(0x7f00000000c0)) 23:49:36 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1500.330819] binder: 2244:2249 transaction failed 29189/-22, size 72-24 line 3138 [ 1500.343210] binder: undelivered TRANSACTION_ERROR: 29189 [ 1500.357313] binder: 2242:2248 ioctl c0046209 0 returned -22 [ 1500.357461] binder: 2242:2248 got transaction with fd, 4, but target does not allow fds [ 1500.357491] binder: 2242:2248 transaction failed 29201/-1, size 80-24 line 3427 [ 1500.359460] binder: 2243:2245 got transaction with invalid handle, 3 [ 1500.359484] binder: 2243:2245 transaction failed 29201/-22, size 72-24 line 3411 [ 1500.364181] binder: BINDER_SET_CONTEXT_MGR already set [ 1500.364188] binder: 2242:2253 ioctl 40046207 0 returned -16 [ 1500.364989] binder: 2242:2253 ioctl c0046209 0 returned -22 [ 1500.435888] binder: undelivered TRANSACTION_ERROR: 29201 [ 1500.441358] binder: undelivered TRANSACTION_ERROR: 29201 23:49:39 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000100)=0x3) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:49:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000140)={0x3, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x141002, 0x0) 23:49:39 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r5, 0x2) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000001340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000e60000000001000000000000000300000000000000b0536d476f28433c77c671b730ac56848fcfe60a0e45ae19adcc2098d02bb062696b5d746095dbf3094959bcf4b9c2d7b9e53116ff857116cce372fffb2353105d297d1cbab6265d9f51f5406d43c4548b2b820af6e4616a5bc7e92ca4c6ce5511eb7f73a6e3aa57930c38d611903c21832df49437ec92d8be6f2c7e37c738b140a28c233f69e65f4122f69baf75b8e6e054deebcb9410ec822ff002b2f8eacf6f0af33e468ad45e977d10fde8d76d1a9c82acee30037c73d9798bf8e0772a322b058e2fa8ee643be1d1cb39aeb7d292eec9f85bf6be686c362b467f3f7a66834a18ecc6c58423a75288050ab64df146ef9c6fb27c04c70df34ce0f39a07896cbb8fcf264e71914168f99c390286f7c9c53331159ae18351c7581f4e625a265d33b757466a77cb5d86a5ccccdcc1623359c9083430018cd27bc3ac6d3322993146fafe03ce5f648d3b29e2c7fea6222ed3258de3b23ad486bab667916c51031b8c66ea284d5e1f9a29d5e47b75e38b69f4187fe0fd94c6a5a92a59fb27f8eac0fff8cb5e9817fc29c6c536ceca7b7dcd382111a1fd0b8dac8c9525157d3fb8578c5b78759c2e7dd70dfed5981e88aa6bb2178a938c4543073781b7195eeb1148f623cbbd38f83bd7848ccad7ab7b8c9efa8be8940bdbec6f6f55a86bac2bfa15d8e0622e0e04a29d70f392d8f2ecde9ae2380317d81ad336b01dc22e17327d3b573bb3c70139a8b81a3d4e281e1121c2933eeb33c0c328ce77c68ac8084092e7651abc056af1a9c316fd353296b0173d422679b7"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RCLUNK(r3, &(0x7f00000000c0)={0x7, 0x79, 0x2}, 0x7) 23:49:39 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) close(r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x2ae, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000080001800000000000000", @ANYRESHEX=r1, @ANYRESHEX, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 1503.237406] binder: 2259:2266 transaction failed 29189/-22, size 72-24 line 3138 [ 1503.247730] binder: 2261:2269 not enough space to store 0 fds in buffer [ 1503.247757] binder: 2261:2269 transaction failed 29201/-22, size 112-24 line 3475 23:49:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fchmodat(r2, &(0x7f0000000140)='./file0\x00', 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = accept4$packet(r5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x80000) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r7, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) close(r7) lsetxattr$security_smack_entry(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='security.SMACK64\x00', &(0x7f0000000400)='\x00', 0x1, 0x1) recvfrom(r6, &(0x7f00000001c0)=""/154, 0x9a, 0x10000, &(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3, {0xa, 0x4e22, 0x40000, @local}}}, 0x80) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:49:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000140)={0x3, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1503.250951] binder: undelivered TRANSACTION_ERROR: 29201 [ 1503.272138] binder: 2262:2264 got transaction with invalid handle, 3 [ 1503.272166] binder: 2262:2264 transaction failed 29201/-22, size 72-24 line 3411 [ 1503.286488] binder: undelivered TRANSACTION_ERROR: 29201 [ 1503.294805] binder_alloc: 2277: binder_alloc_buf size 7414726426801222840 failed, no address space [ 1503.294812] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1503.294830] binder: 2277:2279 transaction failed 29201/-28, size 36028797018964080-24 line 3284 [ 1503.294972] binder: undelivered TRANSACTION_ERROR: 29201 [ 1503.358949] binder: 2287:2291 got transaction with invalid handle, 3 [ 1503.358977] binder: 2287:2291 transaction failed 29201/-22, size 72-24 line 3411 [ 1503.360924] binder: undelivered TRANSACTION_ERROR: 29201 [ 1503.408344] binder: undelivered TRANSACTION_ERROR: 29189 23:49:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:42 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f00000000c0)={{0x2, 0x3, 0x1, 0x1, 0x1f}, 0xffff, 0x1}) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) socket$netlink(0x10, 0x3, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000700000000018000000000000ffffffffffffffde7f0000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300"/112], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:49:42 executing program 0: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x400000, 0x0) openat$cgroup_type(r0, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) mlock2(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1) ioctl$PPPIOCSCOMPRESS(r4, 0x4010744d) 23:49:42 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:42 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:42 executing program 3: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x100, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000001c0)=0x5) ptrace$cont(0x7, r0, 0x0, 0x0) r2 = syz_open_procfs(r0, &(0x7f00000000c0)='net/ip_vs\x00') ioctl$TIOCCONS(r2, 0x541d) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x1) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000100)=0x4) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\b\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:49:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000013c0)={0x28, 0x0, &(0x7f0000001340)=[@acquire_done, @acquire_done], 0x3c, 0x0, &(0x7f0000001380)="d7b99b04ee0497e8b0eb973e97536da820e1fbc6a439579112f5a3f1d587b6ecfba53c6d45898b16f87996aaed04c2c0e15a6ba299eb11a5e99bc63a"}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x5c, r5, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x24004498) 23:49:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f0000000100)={{0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x4, 'none\x00', 0x10}, {@remote, 0x4e23, 0x2000, 0x6, 0x2, 0xfffffff7}}, 0x44) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x6, 0x1, 0x6}}, &(0x7f00000000c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1506.272720] binder: 2299:2303 transaction failed 29189/-22, size 72-24 line 3138 [ 1506.281467] binder: undelivered TRANSACTION_ERROR: 29189 23:49:42 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1506.316500] binder: 2294:2302 got transaction with invalid handle, 3 [ 1506.323415] binder: 2294:2302 transaction failed 29201/-22, size 72-24 line 3411 [ 1506.335409] binder: undelivered TRANSACTION_ERROR: 29201 [ 1506.342733] binder_alloc: 2311: binder_alloc_buf, no vma 23:49:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000300)={{{@in=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f0000000200)=0xe8) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000240)={r2, 0x1, 0x6}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:49:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:49:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1506.342754] binder: 2311:2313 transaction failed 29189/-3, size 72-24 line 3284 [ 1506.367531] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.367538] binder: 2318:2320 ioctl 40046207 0 returned -16 [ 1506.368033] binder_alloc: 2311: binder_alloc_buf, no vma [ 1506.368053] binder: 2318:2320 transaction failed 29189/-3, size 72-24 line 3284 [ 1506.401397] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.401404] binder: 2323:2328 ioctl 40046207 0 returned -16 [ 1506.402020] binder_alloc: 2314: binder_alloc_buf, no vma [ 1506.402041] binder: 2323:2328 transaction failed 29189/-3, size 112-24 line 3284 [ 1506.402954] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.402963] binder: 2323:2329 ioctl 40046207 0 returned -16 [ 1506.403218] binder_alloc: 2314: binder_alloc_buf, no vma [ 1506.403235] binder: 2323:2329 transaction failed 29189/-3, size 112-24 line 3284 [ 1506.434382] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.434391] binder: 2327:2330 ioctl 40046207 0 returned -16 [ 1506.434826] binder_alloc: 2294: binder_alloc_buf, no vma [ 1506.434847] binder: 2327:2330 transaction failed 29189/-3, size 72-24 line 3284 [ 1506.500238] binder: undelivered TRANSACTION_ERROR: 29189 [ 1506.505778] binder: undelivered TRANSACTION_ERROR: 29189 [ 1506.511300] binder: undelivered TRANSACTION_ERROR: 29189 [ 1506.516992] binder: undelivered TRANSACTION_ERROR: 29189 [ 1506.522532] binder: undelivered TRANSACTION_ERROR: 29189 23:49:45 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getrusage(0x1, &(0x7f0000001800)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f00000017c0), 0x4) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) sendmsg(r2, &(0x7f0000001780)={&(0x7f0000000000)=@pptp={0x18, 0x2, {0x2, @remote}}, 0x80, &(0x7f0000000540)=[{&(0x7f00000001c0)="0434bfe6d1d4428bfabf1c62b2b8c0428b3d366042fdffa02daa0ca4f355bfc80e43645708836be08f720760bbb3002909ad82a3b89c072a44d3316fd02103a36460093f57858824eb92ef4041ad02ed290a0e3c72090b6d97c7ee04462186940445a489fda18a6f962fde745c38e8392c06d14f2d5ea166040f99dfff993be0d335d938011f4d7a9c514866eb859b728822c8fec64f6bf02dce9b47b58dfee6a21fc30bc9b409841b8e0688126ef4e2544f7063d5145d00af26b9270250aa436616c1c9c014f87f3c8871960ec20b400ae4fb3d35aac6e17489", 0xda}, {&(0x7f00000000c0)="237244b3c826f903f1dad23f994fe6ad8b036b0734ab0709a6ab93a585ac80a4244cdfaca50447de0fb1ca5a5bb9ad2d3c74b10a9e93b08c5230b237e0d6ef5b7e8d64629b3e14c1a07260be98080dd38081aaf30f044992712ae323d82ebdb6aa5a7279f3e010a8799fe4da77934fb4c819ba676302c556cd012ac4f0a692681e596e4dd703c5f24292819ec53196c6336518e2", 0x94}, {&(0x7f00000002c0)="5c146569a29578d7487cc44b89f1f53bd03b6516eaa85e7a6150f8bd4891824f50e7dad65f94cfccd3435c9053c97c039dd39b6f4715ed14cf18d16e6f3f43f625b3aedd859a518c8006f85309d50b7fe1f83fa1ea332c1ca79c5243124bc565fc428ffa104026fddb93851f8f04a564eeeec0b4c05bbd2e969494f53c0e4ded55077dc2cb16093d0e5c146d72f2e111f4232c278c58d9d9fdc01702893fed1c06561eeb024bb897c776886e42425a0d68cf1146dd1a5f568205e958615e64821f96657107af5eb3e593142bf81fd53ddc118e20c3b0b02c692a9d445852a40768bdc792f8b68a494f53a31eef2749d49a9859fbeae0", 0xf6}, {&(0x7f00000003c0)="2960e4ac833845c2f2e2bf2caa6a24ec86fc745b4775d77ac8f4f5dcaaf5348b49a5cdf80c95aed7d765a9ea1c172f9b65f35c1d51d0dad4d90bc5684ed41079d530869b6206ef0da941", 0x4a}, {&(0x7f0000000440)="1a333655acd5b314c94098b023440c630eaec4683f2459db2538dd835e44b183132cb5e37c2678ec83c78449bd2b4b59a611837705", 0x35}, {&(0x7f0000000480)="036bb35adeed835ba273bb947b3714ff1916a25e8c9950d19e1cab023e69bce356b6255223dc4e467fdc2aa7047d184a08ad31ffd55b7373e2c759d2b692523d808fb72eb185d0c12ef37af4499d2088586773fa68a40b", 0x57}, {&(0x7f0000000500)="3fe9ff1b5fa327dee388a4", 0xb}], 0x7, &(0x7f00000005c0)=ANY=[@ANYBLOB="300000000000000029000000008000008822edb163b886c305aebc82d7d626ca4b91dcc0d0aed7d88dc200000000000048000000000000003a00000001000000b83ea56e31ef8360910749a5ab18cd0b67acdee5bc1ec1d91c3d2877bc40217d6cccf7b51f5bc0201726a7d503cfb60ee13d2fd300000000100100000000000006000000fbffffff68cce0679c6e8ff4820b2654fe1ac5d9853b572a88b3c9164f16f574429949ec0ffe747caea0c5b7fb3cd4ae5e1f1cbf1b257a55e00759d6bf5ba13f4fca25037070728b8d02eb7758f63fca503c1133a25d1f23a356483ec86238af65f40e107b6327787ceb17c9deb004f0c0fae69b9a70bd5adef24597f8a16e7d78e371e18df0c4880ee986ab6e75ad6ff1bc33bb1494a5675357710e40b51b0210b0318c80482e1668b89389d779a1da35058a6ea5492b2e0e3247f116903fa6381128ab3c1752b4c130ef21e46db88f4ba75a50b6e79dd1ba99290f599d6d19d7c56ec97e37d0d67c29147166e085fbf009b5f6acc7bb209bd30e8309000000000000001010000000000000ac0507c97e0000000196e4eaea135f578a638db9666410cad6695a86ee49f3f66fcfb9c6a1cf56acd6acfeeecddaec8466043e9ad9700bbd1787d510adb924876b942c9f4f8666a2bbdcae684a8082015b1da4a7c83763b6ff40988ef0ed9548754250228763c8b024640140bb0da9a59123a8180bf5a264044ca5344eaeeb453f42abf43460eb349d9b6355c85b6666cd8400ac580346fe85c584180cfb8a0d05593140a8a6bc145565f7db6e26ecff770c5c73d61ae5d0dd9184aaa1b09179fd506da2fde4a1848571a5476e57bee2ead92f9147fe5e5177794ce0b2f8efb2b1e7c22686d1d6f9cd363781f6bd0b6cdefad48786dfc513700ceaf79f8312f6675a644d7f25498f915ae01b7d0a93aeae80b83e04f45237db998fc9203db4b88b42a233279753942a6771a32b9a61c101d67b98ac5dee1885f2e92665891a0e01d2d0364ff9cccbdd2ead7de6b189da964dd15b729304c440e3d5e00875607c6928fd0b4337c757390a66ed8d0ab26fceb1997aab3b2cdf003a597583555795b58f9825c7abbb5a5f402053936dcbaa6064bc00d43cb9c2f4f83ca3a4938169d73ef78c395beebd567b044f69480dbdaf637954e4feeffbdcb89ea6406234fd7ada33d5efc131afae8e96756a9b962c136e0dc780f02a387c26e023c052c9a070db9eb7a0308409c0ed27bbd16e2caac7468c2a79de43e43a82523991a6ee97ed2728eaef3e724eeae9aec42da50d809cb085935cb16d3aa6219a86538e333feac5d36cff35e3731b48521f14c798056f72e074edc1c063edc8d58a7bf1092a3f38a75214d571607f6678e5166e3e11bac98ef1d122084fd5d1e16d7eb89f3ae4fd7937ea2a84055b24cdc0f468cdebe0f7e1646f53019dc0939155368001213f88783a4a02e7028bfe2826506fd9bd9af4297196d269d2e13550ce0db8f5373e8d040c873bdf759ea36187242794dd867be5bfc49c12eefdef0af43cfe9183ff008500b8adaf135fdef85ab4e907c52023f33ecb922536fb54c3e42455e1d56fbf6242276c25c8d3e07ca97f27b897247187f6bbe62f0acf450533b75b7b3104f98734d036f2984a325dc0607ea566a34a9afe05d50f50e06f934f74be1f0ad009528377fd36f2ac4b6909de12711e191a571a6b5d875bed68280418047a49ec31996745c3bb8e9a2549cb48865de72414c02d32dae9e26c6a5e17682864a56b1f170e161bb299aab5ed5e7712664dba9c3b7d2c3d615f9feaeeeefea820582e822a09fcc3e82c053237bcef984103f8ba202498381b6df575248eb06a7ddb906b2a796a629d47018fb2378096928c8410e876a08bff1f59748369fd85a3fe05848729f68bf34bf964dc97ffee6d5f35997a313ce48caf4eb8547baf0b7fbd55b848bbea86ec84761ca75652ef00423a2bc0367ee12e19c11083203c009090d51bfdc052aaa38585d3946e7cc5192b947d4d6b33c031ce50e8d99d22947b1f41d71f8abf3784bede77e5fdeb0beb3379ded0d373a236b3198c6e2a5ba8b2e1fab7d2f74bef6747491423fa7244ae4290785b134588a8f510ec5fdb72371e4b0f4dfeb06ca529d3cc1b2e8bbd76a90055f1b273c0835658ba443c40ecab5151138e093bb20fb17da7f10a03b696ae8fcb0ff617cbbd27d5f4dbbdb2adf8c2813c9f0d35fa0a999ad46d5b3afcef7c38a41f5cfc9c72b17219e2fc31ef1fd17789fd47d3a024905b44273477d1ca7083f5e7e8f77df729b4df8ab913180010ace8add3c53324e718ad76dfa4eb89c919b17f2ade8d5458cdb9c6ebb40e48273fcf3e3847715d57cdbc2297a747d0dd170bbbdbc15c6499a17590c8d06d0e48182b1a7e0518e2d391ad49428d862a5a9c433516ea1ce56d8012a25b0953cce15af3db20f83f986a0a939535ed51143fd75281ad8edd7afa368c4e47db55ee76b33b17ad2c493820f3286dacbf5a179dc295a94c04867cf50a43606aa34add817a09a8742a71f67502a4244e1b535dca6a6b6aa875993a6b9ee5d0f6220730df9ac164763bdb864bc1fa3ea705390be0e795fccd3f10e3ec06043285c3636194e757bb2d72174e0c5c2806407443566d8c14c57b74100283304633153220f2239f0620f0e4bb65242fe61747a9ab5903086708d16cfe4e92dd8ed104900e69645984dcf995402a9b595d6cfe6b4ba1d4ab4fb7b5d8d2717db0413f8c952cebcee39b93e4d24d50b092065128c7bfdb6e7eb1a64bbaeaa591214a01c4f29905e7b0558bf00171096ae39dbaf8aef9530e1b86b3119fda6db12b1a17b571eee1a415f34f42ff3881007f0a20bdc4a06f1a0b308982e0ed7b0671db010acf53d637df9ab4330b3b0b3bd481285e55ae3510fa58da7be8cca8a98e8f134ea9c3063fc4213e62f4650081b4b209ca6967b6726f131c77bcc3847c5bad591a193c5856ef3493ad39e439b7b92133be43390d62ead90a2fedf66ea7c7a065472d2094a8811a1d002e83c27f2b225037cbc8ce81eeaefc38bca1e23a180aa3caf5a16eda3fa8743ecc7697e9664be90c017f8ba10878e0d99508f29db53c599dee8b1c185ea9978a56fd63ccc2d776b75e609d6fc4ca848a61ca7604901dc06540c8cf88562b856b7fded2bd3f9829a5b07b621e99307f697d55c9d724aa886f07f72093de5abefb83fc313a6e4eb2bffd42ccf9b0d0cf119e64d1227510d3f02bd2e9874525af8e9bc2c10db4ba1e8e91f9ad727a14b09f50f1a88b4d76dc31b122908f03d579d2ba8036b23d23c5009fbd03dd9146cfcc3f6e5f370d03fae42057dd6aae86c049c1f4e477a4c85a187430da1bec98819733b6da43fa198bd70820ba876c924d34a1e46c704bebee809a8beaff14ecc2939968ef6064fb18723ffca869425324381342eda33557b1a903008155703c75b44eaf639dee99d1ac70621372f9c4a653f1e4144ec6bb7ccde144f8a82c23240b9b59819412f6eca8d750833c75e4bb6945c6eea5eaa764691199cbd8ef5efdf26acd71b04c119dbab419dfbca3762915aaa8f1233490a8f4baa8cbcce2951097cef47ae17caeda47ece911af9543b4a15eef146428c7389aaf06406739ec716a794054e357b57f112897e15ec80505b2105a5b8c29086f8b2b0531ab16b7e718ac283261cc54d936ef816219d1e188cf04c16fdf412dc1be858f72e89b3709a0363cfb5552a5d3296c4b68bab5a1cc8dd33ff1afc52277e1863d30b4e0460d3500498efa005f399844a1caaf20524eb6f89ae9a3136dc681d9f66f187c5fcae1fc97be48508e71cbe55c57718a03e9af9888661dbe215814e67dc4fe4b04f494495f8bdbef2b03aaed76ed79c34a23528f5dd8acb6622db871a6d272ea721d770b270106b08e71590b7f740b81649dc96801b7d7fc351d9e393fbbe835834fbe1d9d46a65f8d2e967fd7c129757a20679431c13cb9f26539a88958d57a1acd156bd5f3a481e92c78637f8e9693be58f0484cfe937b815a2f8c8bb67a8e486f8307da317f36b27776824b980f06d4b36a14de63a0b07f14d679bb7a12e9a0f22733d6e3e5ef151eec906f17b70e4ac6a462f849af0f713465231abde2ce66401d7e7ccb3f26a254290416cd348a5919c8b636fccc1ec55fd956487f5cf5f01e8d2557d1f6a70d52e6d9b7601d9e3da98bd5e00f6311aba7e6fbc07744090b9b1d6572cb61364af86034a105309199389678b5d0d7c6deac9e35d875016585ddbdba7ebe3da8ced56cb4190f15c50faa30baf8ca365e6237755a8dd5e447f618eb79cc9fa571cde28e014db2b5addbd640a231ec0d62db5a0fdb7780ee4d9986bbc015c5d332a69b3d8a2bc6ceba358312dc597ade4be5523d122e587ef590b0c2bebafd4aa4193b0e496c4859f0b75d1a2cf9fd660fdfa6321f4e187ba5176c815e8fc0df4e8ac700c08a6a10559d415116473b0cac27afcef3d1d650a480b440e4b6dba1648e825dfc047886e8d4185178d908f447952d7f2f35c2e3ec7171c6f0e898c921f8fc4f5ab861503d7ebf234e9536132468ccd7764b9ffb54a8dde0c8d1366209e5d41331637a2ce5d6986f5c56229083ae2c7f9e6555e5779ecf39e007b0d0370076f03f00879653b33cd557a322d1ab6e50af6224318b7490f1a7c879411bc5d02d1dd1b2fe60e831a5b173e0e95ec6c9e1c90cc54bfeb9a27020a02e0ddc3866864885c8f1433871ec151999c27c36605f0ce35c9db141d7ad8f3add602b6dbd3f5dbd8739d9e3925a19c47591f980c2b8744e04557ddc40757ab872a05cf43d76250ae1788df6c67e01b220cc79d1b4c46f8a1860e42a23b3ad260aecbcf5d9a0134d82676a0ffc70fd8ce34a5622bfbe0fe8b27f06ce58571f2baa593fa6be0cb0cbc845c8b89fdb86a45389484835cf750ad5cb4af130a5f2fa327a262842555d468d03ae451b4c40d8128045d33e4af72def46499226f417eb28954832d8d830956c9aa83f9066866fdcd3cf9596d9cd39be5c7d867141622d299ac9dffe542966c241d0c81e1cc787d8dc52c66cb628de48f6086b844f0a243f4120a9bf2a166a12f6dc97f239e8d57006d4bae404bc20fbc957c9162ea794d7d76a4b0ccc1326f27163c1ec0867870514be8da43299eb926b81cffc7dd3e6631a03c66250b9c100ba0359b38018aca58002384f4d529d8acfc5277c823f1778f3fe206cf14e9b50e71a1aad359006a1e837a24817b241a6005cfac0be2fb7892dee705dce077c300b6fbd2b7284182910681e4cf12cfee343ebdf25203a156532d8d310358f0074e520e83381bc3a353f264ed811482e1ddda72ef95b31f7b3b3e5d4569b47fba6752e1daa776cf0f31cdcde6057076657508651b057576e08a5f4c791e534859a0f9afc459590f7643dbf32acd5ca7506bd9679a6fee498bd3ae6379b7fe88c5875dbde04f3ac6046d0c5cfd53ec97bbff76d7b672b19f086403dd531d544bca7911d0a06ec864bb6a982d89bbc2e38587ee6f3b293d1e1c920d98ebac2044be9f254b375adf0b4cfc2e1cca72c5d7e0dfe73a5c9d32147ba81b869be97d21a8ece073614919bd9d9f42a5e7f79d4aa380128f1c83c706d66cc55f5e1a6d4397b7fe3ee55da83a44982aeb028d21c0cd1aee8b033a62bf6b88504a69572fb0d76713ab15e26d35ae1df048c977fbfa860590f449ce0a8c626f13500eeeb5fca9588eda49ff7e714410ad5a4936583f97aac438675caa3164932c39bea1023cfac1f09262c36fbaaf851ee299606f00950e500caa1388fc3728a650287091c5879b503b1c6e6d6f719030d248292add7d2a20701d21cdfd4f68f029da706d335169f37fde2ed9bf6c355d5d4aefe0e021925178e4c6819b0e58089802dc523f1792947040f791aa9bd1be74545e3a04d42f15ed9027fd230f5ef6ba0f7be966f75ea9565deb2a9914e8e3c9d6d7ab7cde4e5971d65bb2673b0443f372b939fc61c9cc214f930c47582255afa287a9166a5fd4fe06c29c0e7bf4c481101e1941cc6d4089c314c52d077bbbe53f3e70f86dc3b99b6339e3d4b4ee0ff717de61a0f8f7a74bd7a2ce64aaf5e937e17a12d05cbf283ad62ceae71422f7a33739be2b405ea6a6ff9f9e2cc26b2510f8c160e071397ff2e47664c61ddd024fe5f260665ee71ce334c5e73c40399d93e13d0373a3521e3fd0cf7dd89abffd864bfc98e534d01bfb2793e0dd2f0d26d63f5ae6c2b869df0e754395ca39bb81d67bae284a811b3215d23dd607deda5b23556f83b2aaf10a2ed02f411d8e3a35382c52d70f9c21ed063cdaee01900bbbf41"], 0x1198}, 0x20001004) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) prctl$PR_GET_KEEPCAPS(0x7) 23:49:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) io_setup(0x80000000, &(0x7f0000000100)=0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f00000003c0)='/dev/loop0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='fuseblk\x00', 0x3012004, &(0x7f0000000540)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x9}}, {@max_read={'max_read', 0x3d, 0x5aa}}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x100}}, {@max_read={'max_read', 0x3d, 0xffffffffffffffff}}, {@max_read={'max_read', 0x3d, 0x8}}], [{@fsname={'fsname', 0x3d, '}'}}, {@fsmagic={'fsmagic', 0x3d, 0x3f}}, {@fowner_lt={'fowner<', r8}}, {@fsname={'fsname', 0x3d, 'md5sum'}}]}}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) write$P9_RSTAT(0xffffffffffffffff, &(0x7f00000006c0)={0x42, 0x7d, 0x1, {0x0, 0x3b, 0x2, 0x8d, {0x20, 0x1, 0x7}, 0x2000000, 0x0, 0x7, 0xfffffffffffffeff, 0x0, '', 0x0, '', 0x8, 'max_read'}}, 0x42) r9 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/hash_stats\x00', 0x0, 0x0) io_submit(r2, 0x2, &(0x7f0000000380)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x6, 0x7, r3, &(0x7f0000000140)="cf8d03", 0x3}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x1, r5, &(0x7f0000000200)="6c6c06ada7bb96d3f0e7db334c45bdf1f3271fee05bf33d7813e7e67e238e40549c0e42a4b690bc7d9861e0c9b9852121e9188ed756155e8b038a1fa544def91fcc88311e6", 0x45, 0x1, 0x0, 0x6, r9}]) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r11 = dup(r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) ioctl$EVIOCGUNIQ(r11, 0x80404508, &(0x7f0000000740)=""/145) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) 23:49:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x86, 0x0, &(0x7f00000001c0)="dd3d4a5826ecaebce08540f735649e0a21dc915b19698147aa7c14160ec4675c126bdce4c9375a245f452100d28e1b9fdfb5520e8b41a24f47305f5a6f8ceb4422c31546e72e2edcbed1635c6316399609bdd929cd872eb140a5f716ba0356b7bf9a411ce35a5b54104d6e883204063de18db968b3ea7cbd757a8d4deea57da183e25df99bf7"}) 23:49:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f0000000180)) [ 1509.288028] binder: 2335:2338 got transaction with invalid handle, 3 [ 1509.296228] binder: 2335:2338 transaction failed 29201/-22, size 72-24 line 3411 [ 1509.304052] binder_alloc: 2334: binder_alloc_buf, no vma [ 1509.304071] binder: 2334:2340 transaction failed 29189/-3, size 72-24 line 3284 [ 1509.304724] binder: undelivered TRANSACTION_ERROR: 29189 23:49:45 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r4, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4e20, @rand_addr=0x8}, {0x2, 0x4e20, @local}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xa1, 0x0, 0x0, 0x0, 0xff81, &(0x7f00000000c0)='bcsf0\x00', 0x9, 0x6, 0x8001}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x1fb, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840000000000000000000000000000000ffffffffffff1800000002000000c4ea161a6d7dfec34b0850d0e5eb956af611557ce76fd4010f1b70f1824b179361d6e7bdad42c1c128db5a1dded4cb9e2dcfb920f9e10508b9a3c28b347ac5cf41636c17154f3e802a8ec729a3a30700000051d1539b016ca09898fc0a47315d0b647022ff230d64a4062feab91a825e02c04d4d3908802c95b57aeec423a8950381030107dd7ad8950732a80bc9e118107e5cddaf0e755fd3f5ad276a5c58e10af92a709aa1bd3de6ba37d598e55d55b144128f5e113e56317d5c7060ccfd4fc10857029a1a024bfded60adcdd1339483ba456c424b7c6199e301f469fcb830af74a03ba7bc302749366ee1b2691c80c78379414586988c5374a86350b7b1df3eef903efb0604695ad5d4dd4221cfe0bf2f5630f5ec0afbadcbb0f4c74c3dc07c0ebf3587ffe512a10f402a9cb988197f3d1f37ed3adaf4b5fe8d855b33be00"/376, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/176], @ANYBLOB="b00000000000000002000000000000003500000000000000856164660000000000000000000000000200000000000000350000000000000085616466000000000000000000000000ffffffffffffffff2d00000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:49:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1509.328523] binder: 2347:2348 not enough space to store 0 fds in buffer [ 1509.328691] binder: 2347:2348 transaction failed 29201/-22, size 112-24 line 3475 [ 1509.330161] binder: undelivered TRANSACTION_ERROR: 29201 [ 1509.358079] binder: undelivered TRANSACTION_ERROR: 29201 [ 1509.392887] binder: 2353:2357 transaction failed 29201/-28, size 5766942628008258842-6129951505470186960 line 3284 [ 1509.394465] binder: 2351:2358 transaction failed 29189/-22, size 72-24 line 3138 [ 1509.394747] binder: undelivered TRANSACTION_ERROR: 29189 [ 1509.423190] binder: undelivered TRANSACTION_ERROR: 29201 [ 1509.429626] binder: BINDER_SET_CONTEXT_MGR already set [ 1509.436146] binder: 2353:2362 ioctl 40046207 0 returned -16 [ 1509.436420] binder: 2356:2360 got transaction with invalid handle, 3 [ 1509.436445] binder: 2356:2360 transaction failed 29201/-22, size 72-24 line 3411 [ 1509.438885] binder: undelivered TRANSACTION_ERROR: 29201 23:49:48 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r1, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:49:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a747000eaeb000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:49:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163d8665347964b0000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:49:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:49:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000013c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009916d18b7007c7a2a687be5300531aebe2ba16fd2225c4d34efd3c1675ce33b503cf98b56ede5b64236a859bb1c2ef8b8beb3ba1aa7885985213b49339ef151b3d7e0e491196c29b4ba512975c8121ece71ba151bf215ac1daf6d64d6f387a9cf8fb21e0dbfb918f9f4f2a3b7c880ac1f585329dbdc45ea0771e787aee458a5946f0d5af5dc940b4ec59b3da240e8e"], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1512.304624] binder: 2364:2368 transaction failed 29189/-22, size 72-24 line 3138 [ 1512.313728] binder: 2366:2369 unknown command 1725457169 [ 1512.313737] binder: 2366:2369 ioctl c0306201 20000180 returned -22 [ 1512.316186] binder: 2366:2376 unknown command 1725457169 23:49:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:48 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r4, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$P9_RREMOVE(r2, &(0x7f0000000000)={0x7, 0x7b, 0x2}, 0x7) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) write$binfmt_elf32(r3, &(0x7f0000000880)=ANY=[@ANYBLOB="7f454c4681040301020000000000000002003e00a5fcffff9003000038000000e1030000440f00005e002000020005000300880900000000ae96985804000000bc1700000008000000000000060000007f0000000002000007000000080000006931f137ff0700004c0000000000010003000000001000000af387115c370cae17569df76a3f852af8eace7923385dd247bca02ba8f1e471549405c1eca96d451d78d9a750a90edc7f1270163b6581d17cfa0cc4a302cbc578089f4c5db748365708850c11a7205a7bf7eb449a38920a20874475f182d7863c85f1a901dbd88721a14aa61c89373745d6d054a57f93a71bf0eddb7727626bc80803d976d24525b64b9acd3baef053dfd375de5230fcdee18baa188c0b797189b2b9e1c397e46eb0eb52bff624770511bf4e29d83d341f00b859af10ab900b634b5c01415adea6c59d2de0b7692c7c552a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6a8022e0bcad5c1245e06792300"/1367], 0x54a) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) write$FUSE_IOCTL(r5, &(0x7f0000000840)={0x20, 0x0, 0x2, {0x8a3f, 0xc, 0x7ff, 0x2}}, 0x20) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a7470000000000000000000000000000000000000000000000000000000000000000000000000856164660000000000000000eab34066f54877b75a845c0000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="b542b2fc5a240a1c21e2517e1f77552a86a11ebd44f3d456a07b9774a792196bac80f5d3581b1f650b14d6d2003744068e36331645678c35a5f5b4b66209b59aea2f23b123a0266a6d5925d31a2b3375bb4d6d9e25c70e089f466b5e61909351efd2c4dd431bc9e90a6beaf06e97a83bcd3782ad3ae7cfb051ab73"], 0x0, 0x0, 0x0}) 23:49:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet6_tcp_int(r2, 0x6, 0x11, &(0x7f0000001340)=0x8, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000240)) r5 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0xce29a0042a3a03b) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000001c0), 0x4) openat$cgroup_subtree(r7, &(0x7f0000000140)='cgroup.subtree_control\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046205, &(0x7f0000000100)=0x40) prctl$PR_GET_TIMERSLACK(0x1e) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7070000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004ebc00"/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:49:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1512.316193] binder: 2366:2376 ioctl c0306201 20000180 returned -22 [ 1512.334639] binder: 2370:2374 got transaction with invalid handle, 3 [ 1512.334668] binder: 2370:2374 transaction failed 29201/-22, size 72-24 line 3411 [ 1512.335969] binder: undelivered TRANSACTION_ERROR: 29201 [ 1512.390663] binder: undelivered TRANSACTION_ERROR: 29189 [ 1512.417303] binder: 2393:2395 transaction failed 29189/-22, size 72-24 line 3138 [ 1512.426161] binder: undelivered TRANSACTION_ERROR: 29189 [ 1512.434043] binder: 2386:2392 got transaction with invalid handle, 3 [ 1512.443955] binder: 2386:2392 transaction failed 29201/-22, size 72-24 line 3411 [ 1512.452883] binder: undelivered TRANSACTION_ERROR: 29201 23:49:51 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r1, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:49:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r2 = dup2(r1, r0) tee(r0, r2, 0x0, 0xa) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:49:51 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:51 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, r4, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@alg, &(0x7f0000000140)=0x80) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:49:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r2, &(0x7f00000000c0)="8eceeb439aba1299bdc05ccd176caa7a87438e2d058ccff36fa48981c15ef95d86824d9523fe4a9f2cdae3cdede50591f311789a2f209d76551b6ce7c0ba072ecc5539d7a1105ace7d88645f00f0e764faa7edb86c8c96fc4ffb4b7302777ac48e8fab5fddf6bb571ec45f0babeafc3f36", &(0x7f0000000140)=""/33}, 0x20) inotify_add_watch(r1, &(0x7f0000000200)='./file0\x00', 0x62607c1c3502948d) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/enforce\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x8001) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000000000000000000000000000000000000000000000000000000000000000000085616466000000000000000000000000010061e1c618bbeadc6cfd2f608251b0"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000240)) 23:49:51 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000001340)={{{@in=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f00000000c0)=0xe8) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6, @random="1b7f457e9d4a"}, 0x10) 23:49:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000130000000000000000000000a2feffff000000000900000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000020000000000000000000000000000000000000000000000852a6277000000000000000000000000000000000000000085616466faffffff0400000000000000010000000000e4ff0000000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000e8d8947177557edb39b1eb73107b976fbd26daa74818809112f9be36232453f4dd84148d0684acee3ca33af3346cc08918edba101c0958b43745d6a20fb1c675729e3f9889fd7898c8b63b002f76e06c558cb36b005c1e84c607f784db3fc3873208a8cf5a1cd369b99dd3bb168505eeebcb0ae7769e77f4c27ee6472182d12451509cfeac5e83d126cc38f0f4419457a270d35669b71edf19"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x5c, r4, 0x2, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 23:49:51 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1515.353597] binder: 2412:2417 got transaction with invalid parent offset or type [ 1515.360116] binder: 2403:2406 got transaction with invalid handle, 3 [ 1515.360145] binder: 2403:2406 transaction failed 29201/-22, size 72-24 line 3411 [ 1515.361640] binder: undelivered TRANSACTION_ERROR: 29201 [ 1515.420544] binder: 2412:2417 transaction failed 29201/-22, size 112-24 line 3454 [ 1515.432763] binder: 2421:2426 got transaction with invalid handle, 3 [ 1515.441184] binder: undelivered TRANSACTION_ERROR: 29201 [ 1515.442081] binder: BINDER_SET_CONTEXT_MGR already set [ 1515.442090] binder: 2412:2424 ioctl 40046207 0 returned -16 [ 1515.462707] binder: 2421:2426 transaction failed 29201/-22, size 72-24 line 3411 [ 1515.472593] binder: undelivered TRANSACTION_ERROR: 29201 23:49:54 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r1, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:49:54 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0x8}, 0x8, 0xc0800) fsetxattr$security_smack_transmute(r2, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:49:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:49:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:54 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) timerfd_create(0x0, 0x800) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffed6, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x100000, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x91, 0xcf, &(0x7f0000000280)={@flat=@weak_handle={0x77682a85, 0x181, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x40000, 0x1, 0x7}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0xffffffffffffff05, 0x0, 0x0}) 23:49:54 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:54 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1518.346451] binder: 2434:2436 not enough space to store 0 fds in buffer [ 1518.374684] binder: 2434:2436 transaction failed 29201/-22, size 112-24 line 3475 23:49:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x7ff) r2 = accept4$inet(0xffffffffffffffff, &(0x7f0000001540), &(0x7f0000001580)=0x10, 0x80400) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f00000015c0)='ip6gretap0\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001500)={0x70, 0x0, &(0x7f00000013c0)=[@acquire_done, @register_looper, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001340)={@fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x3, 0x2, 0x39}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/75, 0x4b, 0x0, 0x1}}, &(0x7f0000000240)={0x0, 0x18, 0x38}}, 0x1080}], 0x9f, 0x0, &(0x7f0000001440)="04cf47abba97eb24d5163c7c711a8c545c1fb63081aadb5ecce35e317a9e19c85d1a13f1d5ae82973c269db7e7036812ac10b06fb33ab791a5584cd6d81eff9cb00454d3a688800d7cddf80d8425ebcbc6202c76639aeabe170973eb1fa2bcc3a0b96cc3ad9c2c9b7d9c406142ec1c6fbaa441a36d922a665fb03be19705fea300112cc33f21350d26d128c49a9e392b47fa49ce6b86ee90be443fe880591f"}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f00000000c0)={0x8001, 0x4, 0x95}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000201}, 0xc, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0xc77f30241d54acea}, 0x42000088) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000a8af31bb4b12fbd34bf3cddd0000000000000000000000000000000000000000000070000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:49:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1518.390610] binder: 2437:2439 got transaction with invalid handle, 3 [ 1518.390646] binder: 2437:2439 transaction failed 29201/-22, size 72-24 line 3411 [ 1518.391999] binder: undelivered TRANSACTION_ERROR: 29201 [ 1518.435598] binder: undelivered TRANSACTION_ERROR: 29201 [ 1518.441132] binder: 2455:2458 got transaction with invalid handle, 3 [ 1518.441159] binder: 2455:2458 transaction failed 29201/-22, size 72-24 line 3411 [ 1518.448801] binder: BINDER_SET_CONTEXT_MGR already set [ 1518.448810] binder: 2434:2460 ioctl 40046207 0 returned -16 [ 1518.474450] binder_alloc: 2462: binder_alloc_buf, no vma [ 1518.474468] binder: 2462:2463 transaction failed 29189/-3, size 72-24 line 3284 [ 1518.507596] binder: undelivered TRANSACTION_ERROR: 29189 [ 1518.513406] binder: undelivered TRANSACTION_ERROR: 29201 23:49:57 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x2, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x400000003d}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x332, 0x0, 0x0}) 23:49:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:49:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000001340)='/selinux/checkreqprot\x00', 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000041800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x39) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000001380)={0x3, 0x70, 0x5, 0x16, 0x1, 0x40, 0x0, 0x9, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x7fff, 0x9, @perf_config_ext={0x8, 0x6}, 0x80, 0xff, 0x2, 0x6, 0x0, 0x7, 0xfff}, r3, 0x1, 0xffffffffffffffff, 0x1) fcntl$getownex(r4, 0x10, &(0x7f0000001400)) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_genetlink_get_family_id$fou(&(0x7f00000006c0)='fou\x00') sendmsg$FOU_CMD_GET(r8, &(0x7f0000000780)={&(0x7f0000000680), 0xc, &(0x7f0000000740)={&(0x7f0000001640)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="00083dbd7000fddbdf250300000014000700fe80000000000000000080000000001e080001004e2000000cb766afc235e689bf5a21000332bcae29a137eb951e62130af3b62c68950acbe4898691d3f91bc4fc3534c94b0d8398fb3ee3d5b8f29b37a25f201c4fc1bb3c4739442f56f6730ca60c0f4a3dafea47cc9e1651453e9552c189bf8206b68392b65cd2f79e47fff85506f8726706ec9dc6598b399a1164dc40695352345065b0394bbbeb6eda7cdd7de133d07d25425aa94fddc39bde7b6a29c0cd1ef71fe8db19aa8f534e62a570cac8657f7d4bf8af0230e6a94dd60ce6"], 0x30}, 0x1, 0x0, 0x0, 0x15}, 0x14800) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x70, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x25, r12}, @IFLA_LINKINFO={0x48, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x38}}}]}, 0x70}}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000001480)={@initdev, 0x0}, &(0x7f0000001500)=0xffffffffffffffea) sendmsg$FOU_CMD_DEL(r7, &(0x7f0000001600)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x4008110}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x68, r9, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0xbcf542249bf31f5f}, @FOU_ATTR_IFINDEX={0x8, 0xb, r12}, @FOU_ATTR_IFINDEX={0x8, 0xb, r13}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast2}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @empty}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x8105) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000240)=0x7ff) sendto$inet(r5, 0x0, 0x0, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @broadcast}, 0x10) sendto$inet(r5, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@random={'trusted.', 'posix_acl_access\x00'}, &(0x7f00000001c0)=""/82, 0x52) dup3(r0, r5, 0x0) 23:49:57 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, r3, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:49:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f00000014c0)=0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001480)={0xb8, 0x0, &(0x7f0000001380)=[@release, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000000c0)={@flat=@handle={0x73682a85, 0x100, 0x1}, @flat=@weak_handle, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}}, @clear_death={0x400c630f, 0x3}, @request_death={0x400c630e, 0x3}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x4, 0x0, 0xe}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/34, 0x22, 0x1, 0x36}, @fda={0x66646185, 0x7, 0x1, 0x2a}}, &(0x7f0000001340)={0x0, 0x20, 0x48}}}], 0x40, 0x0, &(0x7f0000001440)="3a8fd6e130bbc67b3ae6cc7444462dcbe21617c661145471642d691941e4428821b5169074192e0ad3d4dc8e9001be5ad78c8a154e85b8dfec094863c97f0dc7"}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r3 = dup(r0) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000001500)={{{@in=@dev, @in6=@loopback}}, {{@in6=@empty}, 0x0, @in6=@mcast2}}, &(0x7f0000001600)=0xe8) 23:49:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/nende3\b\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x44) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) io_setup(0xb3, &(0x7f00000000c0)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_cancel(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8, 0x1ff, r0, &(0x7f0000000100)="a7d5bc25384d9d4360ca91fd4dd94263eaf57bc3d7f818ac679a6186095ac049e098f7c3728771b7d7462c8fbef320ccd78791a64234a18281196b6a421e0d02ad67904808044416190f6f68b6de676f67b0f634cd684a5e62efdb5c5c2aa76489727cac4453798c0a2363b5", 0x6c, 0x1, 0x0, 0x1, r3}, &(0x7f0000000200)) pselect6(0x40, &(0x7f0000000000)={0x7ff, 0x3, 0x1, 0x2, 0x0, 0x1, 0xfffffffffffffff7}, &(0x7f0000000040)={0x7a, 0x40, 0x0, 0x81, 0x100000001, 0x4, 0x3, 0x1ff}, &(0x7f0000000180)={0x5, 0x5, 0x4, 0x400, 0x4, 0x7fffffff, 0xa70}, &(0x7f00000002c0)={0x0, 0x1c9c380}, &(0x7f00000003c0)={&(0x7f0000000380)={0x401}, 0x8}) prctl$PR_GET_TIMERSLACK(0x1e) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000340)={0x1, &(0x7f0000000240)="886cb9d4a5ab09695ab0d64297a722d86883aa89b2289d9daa9daa2ea3", &(0x7f0000000300)=""/32, 0x4}, 0x20) [ 1521.378496] binder_alloc: 2465: binder_alloc_buf, no vma [ 1521.385130] binder_alloc: 2467: binder_alloc_buf, no vma [ 1521.385151] binder: 2467:2470 transaction failed 29189/-3, size 104-24 line 3284 [ 1521.385168] binder: 2467:2470 ioctl c0306201 20000180 returned -14 23:49:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/policy\x00', 0x0, 0x0) syz_open_pts(r6, 0x2040) utimensat(r5, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0) getsockopt$bt_hci(r4, 0x0, 0x0, &(0x7f0000000140)=""/7, &(0x7f00000001c0)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCGPTPEER(r3, 0x5441, 0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1521.385394] binder: undelivered TRANSACTION_ERROR: 29189 [ 1521.412812] binder: 2464:2474 transaction failed 29189/-22, size 72-24 line 3138 [ 1521.414984] binder: undelivered TRANSACTION_ERROR: 29189 [ 1521.464875] binder: 2484:2487 transaction failed 29189/-22, size 72-24 line 3138 23:49:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:49:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000300)={0x7ff, 0xfffffc00}) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fe, &(0x7f0000000200)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'syzkaller1\x00', &(0x7f0000000140)=@ethtool_link_settings={0x4c, 0xffff, 0x2, 0x3, 0x80, 0xc9, 0x8, 0x7f, 0x80, 0x1f, [0xe7, 0xffff, 0x7, 0xb2c, 0x5, 0x1ffe, 0x4, 0x57e1], [0x7, 0x0, 0x672]}}) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x67, &(0x7f00000000c0)={@local, @multicast2}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x101}) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000001400)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000059290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007ef4791047db000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000acd4ef6fe7d664b708838036000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a2da2615997f527000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d8b9f5aab40689cdda28190a36b768c880776d0dc518f0800778864e875546361b1291bad388103ea23928ba771762a6f257d8bee038c8b9d4b5df3b4454d03ffb50798bea4c5008a5c8582f00d758c9f9bca9dc0cc924993b457d2e59208238ff39d46f32097e0e56fc53bda89a1069dec7abe44925ab93ec0b623f8540114c8cb4953ed8a3b23890a4b5f593301422b0797789ed00c4f00382031bc600ae3f33ac2fcae87155b9e39bb19ea80d3d7d6adb300ac225ce5c577b9fd46908aab26429ecc332ec905c36e4"], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1521.466386] binder: undelivered TRANSACTION_ERROR: 29189 [ 1521.485757] binder: 2465:2471 transaction failed 29189/-3, size 72-24 line 3284 [ 1521.506963] binder: 2491:2492 transaction failed 29189/-22, size 72-24 line 3138 [ 1521.508404] binder: undelivered TRANSACTION_ERROR: 29189 [ 1521.541132] binder: undelivered TRANSACTION_ERROR: 29189 23:50:00 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0xa, 0x1, 0x40}, @ptr={0x70742a85, 0x0, 0x0}, @flat=@weak_binder={0x77622a85, 0x2000, 0x3}}, &(0x7f0000001300)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) 23:50:00 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x2, 0x7d7c5389e753ef03, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000016c0)={0x60, 0x0, &(0x7f00000015c0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001500)={@fda={0x66646185, 0x4, 0x1, 0x18}, @fda={0x66646185, 0x9, 0x1, 0x1e}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000001580)={0x0, 0x20, 0x40}}, 0x1000}, @acquire_done={0x40106309, 0x2}], 0x54, 0x0, &(0x7f0000001480)="d3bc24001665405a003dd1823830002def2601b51761cc418b6f8e74ae72ca10cbf3422448d090e0821ff1ee054000000000000049b635f54a4a1418b4c67c4b10836b2c94fc0f52954af5b05694000000000000"}) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r5 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0046209, 0x0) r6 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r7, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, r7) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001440)={0x84, 0x0, &(0x7f00000001c0)=[@clear_death, @request_death={0x400c630e, 0x3}, @enter_looper, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x73622a85, 0xaf6d4f7df652f0a9, 0x2}, @fda={0x66646185, 0x7, 0x1, 0x1e}, @fd={0x66642a85, 0x0, r6}}, &(0x7f0000000140)={0x0, 0x18, 0x38}}}, @enter_looper, @free_buffer={0x40086303, r4}, @dead_binder_done], 0xfc, 0x0, &(0x7f0000001340)="5260ca72a1eaaedb0db35556ad75f7005ea4da58ec7bcab5778503c13c0f7325b45ce7832cc1e3e0a1ab917f9fdc4535fa09662176ace1fc659a45bdbb1fb0bfc263fb8167a1b15384f5fc0e9cedfa60c7e3b743228572b07fb075d922eccb222ebbb6b4b1e0a9c0b9f39f70dc1b616ba4ab6fb23606a57c6a8d27697cda275d5f45f71979d9c0b1e42c67c51c00aa5d27239ad04050a7935adae2b90ab7cf77603efe50255d56f00c5627680a01acfa6a6ff3135a4502d49b328de5ba3bc2f4a8a0289c3df36cd63e73fe39362dea9e0e79d39db5bb7a3d1b3746d3946e2d6d98b5cf836703a17761bed08378fc7caaff381e67e451a29d0d38ec47"}) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r9, 0x0, 0x0, 0x200007fe, &(0x7f0000000100)={0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x14}}, 0xffffffffffffffde) sendto$inet(r8, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000001700), &(0x7f0000001740)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:00 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000001000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r3 = inotify_init() fstat(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r2, 0x0, r4) r5 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r6 = inotify_init() fstat(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r5, 0x0, r7) stat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x2, &(0x7f0000000040)=[0xffffffffffffffff, 0xee00]) getgroups(0x4, &(0x7f0000000140)=[r4, r7, r8, r9]) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000007000000000000000180000000000000006d70d012c264208a6f77796a59482b45af290e63e6a7bbb28dec784cd16e6831531c3db14d655df557e9e7ca9101db8c06ad419b37a331e4cae59f7fdddd55bd34a3c4c168057c89982937d9e5a20746efe3013336e23be4a8e2a482e48ef40561bdd0e4ab9659f18759feace2cc50b78e0038d8c73444d969d4f05351c7075141053351512de2114c3c25f22c48c15063e1ad6de01fcf29d2e184461f7bebe3d710fbfde84c73dfa83e1d8f80365dfc89eb35075142ccb3d27d17c1c06ffa30ddedec947f506393bb686a11d745a9a3591f3ad52aa291484703c9b3782bf006ae3ecef0d419e703809bcf5b81dbdd5136a6abd6b7761213f64837d86f2f4aff716679d0d6415a0e13628220a753452d6bde4f8c950f16276", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="2539dd873a0bcf9beda5521efebbbe5e18c204dba05761b5"], 0x0, 0x0, 0x0}) [ 1524.402852] binder_alloc: 2496: binder_alloc_buf, no vma [ 1524.423823] binder: 2496:2504 transaction failed 29189/-3, size 72-24 line 3284 [ 1524.433970] binder: 2497:2503 got transaction with invalid handle, 3 23:50:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000389f0c39d7f610a700000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1524.434000] binder: 2497:2503 transaction failed 29201/-22, size 72-24 line 3411 [ 1524.435577] binder: undelivered TRANSACTION_ERROR: 29201 [ 1524.440563] binder_alloc: 2513: binder_alloc_buf size -4937235748092841240 failed, no address space [ 1524.440570] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1524.440591] binder: 2513:2516 transaction failed 29201/-28, size 112-24 line 3284 23:50:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r3 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000040)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="fc"}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x70, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x25, r8}, @IFLA_LINKINFO={0x48, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x38}}}]}, 0x70}}, 0x0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r10) setsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@rand_addr=0xb73, @in=@loopback, 0x4e22, 0x8, 0x4e24, 0xfff9, 0xa, 0x80, 0x10, 0x0, r8, r10}, {0x7fff, 0x3, 0x9, 0x8, 0x0, 0x2, 0x81, 0x893}, {0x8000, 0xdf8f, 0x7}, 0xff, 0x0, 0x1, 0x3, 0x2f74583c6d4627c, 0x3}, {{@in6=@rand_addr="385c90bdb253f37d1a14be1db62a8e25", 0x4d4, 0xff}, 0xc, @in6=@rand_addr="2427af373f488ddcef106cb4c08d1211", 0x3506, 0x3, 0x2, 0x3f, 0x9, 0x3ff, 0x2}}, 0xe8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000012c0)={0xc, 0x0, &(0x7f0000000300)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) fsetxattr$security_smack_transmute(0xffffffffffffffff, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f00000000c0)=[@free_buffer={0x40086303, r3}], 0x3bc, 0x0, 0x0}) 23:50:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1524.442170] binder: BINDER_SET_CONTEXT_MGR already set [ 1524.442179] binder: 2513:2517 ioctl 40046207 0 returned -16 [ 1524.447697] binder: undelivered TRANSACTION_ERROR: 29201 [ 1524.517591] binder: 2522:2523 got transaction with invalid handle, 3 [ 1524.517620] binder: 2522:2523 transaction failed 29201/-22, size 72-24 line 3411 [ 1524.518363] binder: undelivered TRANSACTION_ERROR: 29201 [ 1524.542558] binder: BINDER_SET_CONTEXT_MGR already set [ 1524.542568] binder: 2524:2526 ioctl 40046207 0 returned -16 [ 1524.542634] binder: 2524:2526 ERROR: BC_REGISTER_LOOPER called without request [ 1524.551593] binder: 2528:2529 got transaction with invalid handle, 3 [ 1524.551621] binder: 2528:2529 transaction failed 29201/-22, size 72-24 line 3411 [ 1524.552148] binder: undelivered TRANSACTION_ERROR: 29201 [ 1524.597120] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1524.597637] binder: 2524:2531 BC_FREE_BUFFER u0000000020ffc000 no match [ 1524.597937] binder: 2524:2531 BC_FREE_BUFFER u0000000020ffc000 no match [ 1524.597949] binder: 2524:2531 ioctl c0306201 20000180 returned -14 [ 1524.630917] binder: undelivered TRANSACTION_ERROR: 29189 23:50:03 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000008800000015422a6cc5cd391a0917fe916100000000852a747800000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:03 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x80000000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(0x0, 0x3b) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 23:50:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f00000001c0)=""/126) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001340)={@ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/98, 0x62, 0x0, 0x20}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x4, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f00000014c0)={'broute\x00', 0x0, 0x4, 0xc9, [], 0x5, &(0x7f0000000240)=[{}, {}, {}, {}, {}], &(0x7f00000013c0)=""/201}, &(0x7f00000002c0)=0x78) prctl$PR_SET_NAME(0xf, &(0x7f0000001540)='#\x00'/13) 23:50:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(0x0, 0x3b) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 23:50:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) getrandom(&(0x7f00000000c0)=""/8, 0x8, 0x5) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="60010000f5ffffff04000000000000000600000000000000070000000000000008000000000000085b73656c696e75780200000000000000090000000000000000000000ff0f0000020000000000000007000000000000000d0000005d5e00002f6465762f62696e6465722300000000060000000000000003000000000065762f62696e646572230000000006000000000000000336d1000000000011000000020000006c6f2a6c6f656d3073656375726974792f00000000000000010000000000000004000000000000000d000000040000002f6465762f62696e64657223000000000300000000000000ff0300000000000005000000e9030000262747504c000000020000000000000080030000000000000d000000090000002f6465762f62696e6465722300000000000000000000000081000000000000000c000000bc0000006574683073656c696e75782a00000000"], 0x160) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getresuid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) getresgid(&(0x7f0000000500)=0x0, &(0x7f0000000540), &(0x7f0000000580)) write$FUSE_DIRENTPLUS(r5, &(0x7f00000005c0)={0x148, 0x81baead457165e33, 0x6, [{{0x5, 0x3, 0xffffffffffff1c2a, 0x8, 0x1, 0x5, {0x2, 0x3, 0x2, 0x1, 0x4, 0xf7, 0xcecb, 0x0, 0x8001, 0x1, 0x5, r6, r7, 0x81, 0x1}}, {0x5, 0x200, 0x5, 0x3, 'syz0\x00'}}, {{0x3, 0x2, 0x8000, 0x5, 0x1b, 0xd1a, {0x2, 0x9, 0x4, 0x5, 0x90, 0x8001, 0x5, 0x5, 0x2, 0x2, 0x1, 0xee00, r8, 0x400, 0x400}}, {0x6, 0x7ff}}]}, 0x148) getsockopt$inet6_tcp_int(r3, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r10 = dup(r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) openat$cgroup(r10, &(0x7f0000000340)='syz0\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00#;\x00\x00\x00\x00'], 0x2d3, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r12 = dup(r11) ioctl$PERF_EVENT_IOC_ENABLE(r12, 0x8912, 0x400200) r13 = gettid() ptrace$setopts(0x4206, r13, 0x0, 0x0) tkill(r13, 0x39) ptrace$setregs(0xd, r13, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r13, 0x0, 0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000380)={0x5, r13}) ioctl$PPPIOCCONNECT(r12, 0x4004743a, &(0x7f0000000040)=0x4) [ 1527.422305] binder: 2534:2537 got transaction with invalid handle, 3 [ 1527.425377] binder: 2533:2541 not enough space to store 0 fds in buffer 23:50:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4c4, 0x2) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x8e18) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(r2, 0x3, 0x0, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1527.425404] binder: 2533:2541 transaction failed 29201/-22, size 112-24 line 3475 [ 1527.425544] binder: undelivered TRANSACTION_ERROR: 29201 [ 1527.427678] binder: 2535:2542 transaction failed 29189/-22, size 72-24 line 3138 [ 1527.427807] binder: undelivered TRANSACTION_ERROR: 29189 [ 1527.472336] binder: 2551:2555 unknown command 992149504 [ 1527.472345] binder: 2551:2555 ioctl c0306201 20000180 returned -22 [ 1527.475263] binder: 2550:2553 transaction failed 29189/-22, size 72-24 line 3138 [ 1527.475426] binder: undelivered TRANSACTION_ERROR: 29189 [ 1527.522688] binder: 2558:2561 transaction failed 29189/-22, size 72-24 line 3138 [ 1527.523086] binder: undelivered TRANSACTION_ERROR: 29189 [ 1527.544053] binder: 2534:2537 transaction failed 29201/-22, size 72-24 line 3411 [ 1527.554520] binder: undelivered TRANSACTION_ERROR: 29201 23:50:06 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x4000, 0x0) ioctl$TIOCGWINSZ(r3, 0x5413, &(0x7f0000000300)) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000001c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="f0000000", @ANYRES16=r4, @ANYBLOB="10042cbd7000fcdbdf250300000000000600000002000000020000000200000002000000020000000400000007000000040091cf00000000020094a100000040030009000000000001001d000000000001001000000000000300010000800000030005000000000002000004000000000200ffffff7f43644ddb12675e01164147036d5cc8818ffbcbf0e01923497ac36b25f372ab1b6b5c7ed467c2b8d6af24c03b1768ad50fbf2954246e759728d8a94dfa8e150a9aaf1d959181c0f17dd5c2f558274243e59a7a758fd32974d96be238ff0af3e3ca94962ad9093e61577a8f28bfb4ed3b0068e529bfa90a6f2855adeaaf8e7085c74e7b20a132affdf79563c89e0476d9b3ffc8dbbbe08da926fae15c6e093fa50e6ceda11620b"], 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x4) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r7, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r7, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r7, 0x8904, &(0x7f0000000500)=0x0) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r10, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r10) perf_event_open(&(0x7f0000000680)={0x0, 0x70, 0x7, 0x5, 0x0, 0x0, 0x0, 0x3, 0x935dec36b4fdc020, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0xffffffffffffff75, 0x100000000}, 0x41, 0xffffffff, 0xfffffffd, 0xb, 0x6, 0x9, 0x1f}, r8, 0xd, r10, 0x18) r11 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r11, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x98, r12, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3f}]}, @IPVS_CMD_ATTR_SERVICE={0x70, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8000}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x2a}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2c}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x26}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x17}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}]}]}, 0x98}}, 0x10008150) ioctl$TIOCCONS(r5, 0x541d) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_procfs(r8, &(0x7f0000000700)='net/nfsfs\x00') r13 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0xfffffffc, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(0x0, 0x3b) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 23:50:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="000000000000000028000000040000005000000000000000"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) signalfd4(r0, &(0x7f00000000c0), 0x8, 0x0) 23:50:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1530.452909] binder: 2568:2573 got transaction with invalid handle, 3 [ 1530.471788] binder: 2569:2576 got transaction with fd, -1, but target does not allow fds 23:50:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) fdatasync(r2) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) write(r4, &(0x7f00000000c0)='Wf', 0x2) 23:50:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f00000000c0)) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:07 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000060000000000000001800"/52, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a68770a00000001000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000014000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1530.471829] binder: 2569:2576 transaction failed 29201/-1, size 72-24 line 3427 [ 1530.472020] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.518434] binder: 2568:2573 transaction failed 29201/-22, size 72-24 line 3411 [ 1530.529400] binder: 2586:2589 got transaction with fd, -1, but target does not allow fds 23:50:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) [ 1530.529437] binder: 2586:2589 transaction failed 29201/-1, size 72-24 line 3427 [ 1530.529766] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.556862] binder: 2587:2594 not enough space to store 0 fds in buffer 23:50:07 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="a029538b3c4a8d9c4a0dec4e36da321d3a1cbcde2d2661136baeba51ca8fdf2d180b7a8c9d23535015922caef9030eb34e33e692ab0311521517be23eabac7e18cf58a3414", @ANYRES16=r3, @ANYBLOB="01012cbd70000000000005000000"], 0x14}}, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x30, r3, 0x20, 0x70bd25, 0x25dfdbff, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x30}, 0x1, 0x0, 0x0, 0x4060051}, 0x40000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}) 23:50:07 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) getsockname$inet(r2, &(0x7f0000000140)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) tkill(r1, 0x9) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028ba9b253383f56ac60c0204eeaf9a5a8bf61e2325e7b310135a1a8c4ce271472f30f0bb18f2b4a3d5fd55df0bdfc007f1bb4179cc4c7d54ca307df07809da9191150173b8969e4f20fd737a9146b8dbc5deffac85eb63fcafc3076e1a84d775be63c3a39e5f71"], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) fsetxattr$security_smack_transmute(r3, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x2) [ 1530.556891] binder: 2587:2594 transaction failed 29201/-22, size 112-24 line 3475 [ 1530.571762] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.602261] binder: 2595:2602 got transaction with fd, -1, but target does not allow fds [ 1530.602302] binder: 2595:2602 transaction failed 29201/-1, size 72-24 line 3427 [ 1530.602533] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.663573] binder: undelivered TRANSACTION_ERROR: 29201 23:50:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x50002, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xb75) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e10a00"/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = getpgid(r1) capget(&(0x7f0000000100)={0x19980330, r2}, &(0x7f0000000140)={0x1, 0x0, 0x3, 0xa0d, 0x4}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x240120, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)={0x8a87}, 0x4) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x1aa, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000e4b4e5b160039f7c588c971d1cf3137a66d83cd8542af4440c2072c115495d436ec8574d16eaba253348415ffd4040c537eeec00b37418b84a8477d2d42caee6547639d2d0069163bd08db826e7ff082e61d212d459a61f836c4d610345841d1cb079daf05026ae4f0956f2d16f47555e31b306f6ab27a23db5df36b7fdf5e807cc9351c71892d2db80ceeee742957bc3b44526eb16a8770c4e6199fc2746e1f92f0b0a81de283033ec83eed9b7018b5f5bd4ded492a2d4c41fcdb6541e9f777c84a39b835b67190d6dfd1f12e847fa30ee94b27", @ANYBLOB="a42470a2d9ed704fc612c13041007796923e65c9b97c4443e086f90f9df97ab12dcd05b31d683891f50e65ba2090374f62644a42a4e70e25fd45021a0aa6c6e209be582a2321b2256971c6fe1cb9c334af2fd321ba309ca3105833ea47a858956fc285a51d783e317f0739800aba85abca71a496b4cfb14e5916618aa539c7d963795a0afad95a3879c84adb216d7f38e747", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00db230800000074"], 0x0, 0x0, 0x0}) write$FUSE_GETXATTR(r3, &(0x7f0000000040)={0x18, 0x0, 0x3, {0xfff}}, 0x18) [ 1530.709104] binder_alloc: 2617: binder_alloc_buf, no vma [ 1530.716892] binder: 2617:2618 transaction failed 29189/-3, size 72-24 line 3284 [ 1530.718817] binder: 2612:2622 got transaction with fd, -1, but target does not allow fds [ 1530.718853] binder: 2612:2622 transaction failed 29201/-1, size 72-24 line 3427 23:50:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:07 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x215, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x3}, @fda={0x66646185, 0x0, 0x1, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1530.719345] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.755735] binder: 2624:2626 got transaction with fd, -1, but target does not allow fds [ 1530.755770] binder: 2624:2626 transaction failed 29201/-1, size 72-24 line 3427 [ 1530.755942] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.799856] binder: 2630:2635 got transaction with fd, -1, but target does not allow fds [ 1530.799896] binder: 2630:2635 transaction failed 29201/-1, size 72-24 line 3427 [ 1530.800207] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.832086] binder: 2638:2639 got transaction with invalid offsets size, 533 [ 1530.832123] binder: 2638:2639 transaction failed 29201/-22, size 112-533 line 3338 [ 1530.832272] binder: undelivered TRANSACTION_ERROR: 29201 [ 1530.832935] binder: BINDER_SET_CONTEXT_MGR already set [ 1530.832945] binder: 2638:2640 ioctl 40046207 0 returned -16 [ 1530.872946] binder: undelivered TRANSACTION_ERROR: 29189 23:50:10 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) ioctl$RTC_WIE_OFF(r2, 0x7010) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:10 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:50:10 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x1f, 0x4, @tid=0xffffffffffffffff}, &(0x7f0000000100)=0x0) timer_settime(r1, 0x1, &(0x7f0000000140)={{0x0, 0x989680}}, &(0x7f00000001c0)) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYRES64, @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="00000016da00"/24], @ANYBLOB="1000000018004e06"], 0x0, 0x0, 0x0}) [ 1533.628825] binder_alloc: 2652: binder_alloc_buf, no vma [ 1533.637535] binder: 2645:2647 got transaction with fd, -1, but target does not allow fds 23:50:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x801) [ 1533.637577] binder: 2645:2647 transaction failed 29201/-1, size 72-24 line 3427 [ 1533.638041] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.641838] binder: 2655:2660 not enough space to store 0 fds in buffer [ 1533.641865] binder: 2655:2660 transaction failed 29201/-22, size 112-24 line 3475 [ 1533.642005] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.666704] binder: 2655:2662 not enough space to store 0 fds in buffer [ 1533.666735] binder: 2655:2662 transaction failed 29201/-22, size 112-24 line 3475 [ 1533.666997] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.685902] binder: 2663:2671 got transaction with fd, -1, but target does not allow fds [ 1533.685948] binder: 2663:2671 transaction failed 29201/-1, size 72-24 line 3427 [ 1533.686196] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.697980] binder: 2675:2676 not enough space to store 0 fds in buffer [ 1533.698010] binder: 2675:2676 transaction failed 29201/-22, size 112-24 line 3475 [ 1533.698269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.699484] binder: 2675:2677 not enough space to store 0 fds in buffer [ 1533.699550] binder: 2675:2677 transaction failed 29201/-22, size 112-24 line 3475 [ 1533.699821] binder: undelivered TRANSACTION_ERROR: 29201 [ 1533.808610] binder: 2652:2654 transaction failed 29189/-3, size 72-24 line 3284 [ 1533.818284] binder: undelivered TRANSACTION_ERROR: 29189 23:50:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="000028b3fad87012589700000000ff005000000000000000"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000001001b00000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000f474cc7975b9bb31d80e949d61025ae0f7151122b1d8675227677f43f74a47fdf35d4aabf8f3f1361f7c36"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:50:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000013c0)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/150, 0x0, 0x0, 0x1a}, @ptr={0x70742a85, 0x1, &(0x7f0000001340)=""/92, 0x0, 0x2, 0x20}}, &(0x7f0000000140)={0x199}}, 0x1400}], 0x0, 0x0, 0x0}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) capget(&(0x7f0000000000)={0x13380342, r2}, &(0x7f0000000040)={0xe, 0x3, 0x2, 0x9, 0x6, 0x7}) 23:50:13 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1536.647644] binder: 2681:2683 got transaction with fd, -1, but target does not allow fds [ 1536.653213] binder_alloc: 2682: binder_alloc_buf, no vma 23:50:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) socket(0x4, 0x6, 0x1) 23:50:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0), 0x7d, 0x0, &(0x7f0000000100)="9eec6861d2edb19fb79a2384c95be047ccd15edff533d1a20c174e80086b85a1f1cbd41b0f9bee4b6569407e18a4f36d06e4db49d7cb120ae057005d1686a6ec1377ac790295b22937593d5edc21f1011e18e41babc3f599e9c8b1950e9408bc71fd4897564006628514a20c62e39017c1039ce78522776d04897d7669"}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:13 executing program 3: openat$selinux_create(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/create\x00', 0x2, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x9) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1536.653233] binder: 2682:2686 transaction failed 29189/-3, size 72-24 line 3284 [ 1536.653628] binder: undelivered TRANSACTION_ERROR: 29189 [ 1536.656656] binder: 2679:2684 got transaction with too large buffer 23:50:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f00000000000000000000000000000000000000000000856164660000000000000000120080000100b313e19d6787c66d468b3f059103"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$RTC_VL_READ(r3, 0x80047013, &(0x7f00000000c0)) [ 1536.656684] binder: 2679:2684 transaction failed 29201/-22, size 112-24 line 3493 [ 1536.656824] binder: undelivered TRANSACTION_ERROR: 29201 [ 1536.685508] binder: 2679:2688 got transaction with too large buffer [ 1536.685545] binder: 2679:2688 transaction failed 29201/-22, size 112-24 line 3493 [ 1536.685859] binder: undelivered TRANSACTION_ERROR: 29201 [ 1536.723279] binder: 2697:2700 not enough space to store 0 fds in buffer [ 1536.723308] binder: 2697:2700 transaction failed 29201/-22, size 112-24 line 3475 [ 1536.727621] binder: 2694:2701 transaction failed 29189/-22, size 72-24 line 3138 [ 1536.728009] binder: undelivered TRANSACTION_ERROR: 29189 [ 1536.728713] binder: undelivered TRANSACTION_ERROR: 29201 [ 1536.729642] binder: 2697:2704 not enough space to store 0 fds in buffer [ 1536.729672] binder: 2697:2704 transaction failed 29201/-22, size 112-24 line 3475 [ 1536.729881] binder: undelivered TRANSACTION_ERROR: 29201 [ 1536.770478] binder: 2707:2709 not enough space to store 0 fds in buffer [ 1536.770506] binder: 2707:2709 transaction failed 29201/-22, size 112-24 line 3475 [ 1536.770705] binder: undelivered TRANSACTION_ERROR: 29201 [ 1536.865580] binder: 2681:2683 transaction failed 29201/-1, size 72-24 line 3427 [ 1536.875510] binder: undelivered TRANSACTION_ERROR: 29201 23:50:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 23:50:16 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000870000000001000000000000000300000004000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f00000000c0)={0x0, @dev={0xac, 0x14, 0x14, 0x14}, 0x4e23, 0x0, 'lc\x00', 0x4, 0x7, 0x66}, 0x2c) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000000c0)={@initdev, @remote}, &(0x7f0000000100)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:16 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1539.662002] binder: 2714:2715 got transaction with fd, -1, but target does not allow fds [ 1539.673303] binder: 2714:2715 transaction failed 29201/-1, size 72-24 line 3427 [ 1539.682820] binder: undelivered TRANSACTION_ERROR: 29201 [ 1539.694984] binder: 2713:2721 transaction failed 29189/-22, size 72-24 line 3138 23:50:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$P9_RLERROR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="16000000762f62696e57523369520000000000000000"], 0x16) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:16 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1539.710349] binder: undelivered TRANSACTION_ERROR: 29189 23:50:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009400"/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000008cfa4437fe7a08fe1fe64fbfc2c43c5c98d4730d040ec199d5034384c98d92e1668fcdcd77f5f4bf6e59f8e8399608a9fcbdd92e481b035f59859ad056bde4e9f5971b6fed6d16bd770b83a89ab871b36d1dfefead436f8282bca00c52adfd5b278df65195ea36e40e0b4ce70cb07d5a565cc0527e"], 0xfffffffffffffe8c, 0x0, 0x0}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f00000000c0)={0x1a, @loopback, 0x4e22, 0x1, 'lblc\x00', 0x4, 0x101, 0x49}, 0x2c) [ 1539.746326] binder: 2727:2732 got transaction with fd, -1, but target does not allow fds [ 1539.767257] binder: 2733:2737 transaction failed 29189/-22, size 72-24 line 3138 [ 1539.768001] binder: undelivered TRANSACTION_ERROR: 29189 [ 1539.788333] binder: 2739:2743 not enough space to store 0 fds in buffer [ 1539.788364] binder: 2739:2743 transaction failed 29201/-22, size 112-24 line 3475 [ 1539.788382] binder: 2739:2743 ioctl c0306201 20000180 returned -14 [ 1539.800414] binder: undelivered TRANSACTION_ERROR: 29201 [ 1539.832129] binder: 2727:2732 transaction failed 29201/-1, size 72-24 line 3427 [ 1539.841713] binder: undelivered TRANSACTION_ERROR: 29201 23:50:19 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 23:50:19 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:19 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000140)) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_getoverrun(r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5a, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="d8204f4ef587f2e8278a0400"/22], 0x0, 0x0, 0x0}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$selinux_attr(r3, &(0x7f0000000280)='system_u:object_r:load_policy_exec_t:s0\x00', 0x28) 23:50:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:19 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:19 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:19 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1542.688186] binder: 2748:2749 got transaction with fd, -1, but target does not allow fds [ 1542.708733] binder: 2748:2749 transaction failed 29201/-1, size 72-24 line 3427 [ 1542.729956] binder: undelivered TRANSACTION_ERROR: 29201 23:50:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = dup(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xe8) r8 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r9 = inotify_init() fstat(r9, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r8, 0x0, r10) r11 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) openat$ion(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ion\x00', 0x3c541, 0x0) r12 = inotify_init() fstat(r12, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r11, 0x0, r13) getgroups(0x5, &(0x7f0000000200)=[0xee01, 0x0, r10, r13, 0xee00]) r15 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r15, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) r17 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/mls\x00', 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(r17, 0x4010744d) setuid(r16) mount$fuseblk(&(0x7f00000000c0)='/dev/loop0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='fuseblk\x00', 0x8000, &(0x7f0000000740)=ANY=[@ANYBLOB="b7eb2c8b25cf1b52433b4e750427350218d62d2bbac5d7069d372aa101a9b4dd3193f782f9c3dc6b81ab732001997a9536f193b46f9612f647342262880f77f077c19721951c9483e42fb2885ce93dabdd9f50a9977923769607a0087c011efb331f44495a4de7139b00a2d2caef0100e22a20f6c0841f4d46f07c5759ace3b45027188dd93c78a535d330731b58e4663cae0cb2b3e7266483ae76b7e0569343", @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r7, @ANYBLOB=',group_id=', @ANYRESDEC=r14, @ANYBLOB=',allow_other,default_permissions,allow_other,default_permissions,default_permissions,fsname=(\'ppp1system,uid=', @ANYRESDEC=r16, @ANYBLOB=',dont_measure,func=FIRMWARE_CHECK,smackfstransmute=/dev/binder#\x00,context=user_u,hash,fsmagic=0x00000000000000f6,appraise,smackfstransmute=/dev/binder#\x00,\x00']) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1542.762518] binder: 2764:2766 got transaction with fd, -1, but target does not allow fds [ 1542.787478] binder: 2764:2766 transaction failed 29201/-1, size 72-24 line 3427 [ 1542.801547] binder_alloc: 2773: binder_alloc_buf, no vma [ 1542.801566] binder: 2773:2776 transaction failed 29189/-3, size 112-24 line 3284 [ 1542.801949] binder: undelivered TRANSACTION_ERROR: 29189 [ 1542.835319] binder: undelivered TRANSACTION_ERROR: 29201 23:50:22 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 23:50:22 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:22 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f00000000c0)=@gcm_128={{0x304}, "325313ba1f4effce", "48fea5802601ea20f945f099c8abdc82", "50d3ab04", "7a951cb0a8697e17"}, 0x28) 23:50:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000d8030000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="00000000000000002800002a1b0900"/24], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:50:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:22 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:22 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:22 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = accept4$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x40800) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x200000e, 0x10, r3, 0xa7f9d000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000028000000000000005000000000000000a2b5291f600cbc387484f6ed12e24d55e629448c1163acd6747bf7cbfcf17d69f09ead858090c17ce704f9fbb27136c22b3fbf588774aba6f9b7d17ad31d2d39d121c515ec5c46feb02a376df5469c36380ecbb5b38dfcc27b14aa302edac83e03989c76fc"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 1545.719007] binder: 2779:2783 got transaction with fd, -1, but target does not allow fds [ 1545.738728] binder: 2782:2787 got transaction with invalid offset (10012273410088, min 40 max 984) or object. 23:50:22 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:22 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1545.738756] binder: 2782:2787 transaction failed 29201/-22, size 984-24 line 3379 [ 1545.738899] binder: undelivered TRANSACTION_ERROR: 29201 [ 1545.794713] binder: 2779:2783 transaction failed 29201/-1, size 72-24 line 3427 [ 1545.807572] binder: undelivered TRANSACTION_ERROR: 29201 [ 1545.847815] binder: 2807:2810 got transaction with fd, -1, but target does not allow fds [ 1545.856516] binder: 2807:2810 transaction failed 29201/-1, size 72-24 line 3427 [ 1545.865129] binder: undelivered TRANSACTION_ERROR: 29201 23:50:25 executing program 2: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000090000000000fdffffff0000005000000000000000d268926ee5930beda68a12cd8be05716ce5c90ecc2e7180dacc319a0d459ee7f93b9fec07b745fa03b37c0e7da5e94665fc128a032d1d253d4106e56fb62ad298575a4f4875769402f6d7421dbb2eb1b28ff07034c3ae1f54cd059633822ddb7da242fbbd2be31aa8b42a88a054c16790c500e58bb8718"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r4, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r4, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r6, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r5, 0x2405, r6) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r7, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r7, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r8 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r9, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r8, 0x2405, r9) r10 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r11 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r11, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r10, 0x2405, r11) r12 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r12, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r12, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r12, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r13 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r14 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r14, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r13, 0x2405, r14) r15 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r16 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r16, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r15, 0x2405, r16) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffc5a, 0x0, &(0x7f0000000700)=ANY=[@ANYRES64=0x0, @ANYBLOB="0253cc0dd9f7268b08a512e89be40e29d419a635704ac0dcba6dd872693b2304a1dd47ae5f92115f28475ba0dd1f04006528cba24507e81e3f1da43c71b13874a87e3559295997985d1f0ebafb2920b7ffae289d132abc554ba031a9e227fffbd4d4b09d2f5a7bf1f3315af1cc70608d79430e097db2a4eebff3b0a0ecb9bd19c0b31e233066507d52de921fb40c9ecdc948c160d4e6e8be2ce4", @ANYRESDEC, @ANYRES64=0x0, @ANYRES16=r12, @ANYRES16, @ANYBLOB="e77328b2f552a1e075a66bef54764aadd1cd642ab68d7b0efb5ecfdd8f4ccfd57b633238948b080919c2045bf197df42c3cddadba38c88c24f5bb6da022d8f44c2676a2f57b47dfd8773b8a7feddc856b732a202165359fe37a7dda8613ccd5e40759f616f66013a9a37a435eb1efb88fdce690340ae50980839b9b33955a0ddea77173a695b8161cab3f0b71b0172b9c0601f2843b9b5cab0c23d81108db049c5fdcae2fb3a91c063844d8b8b444ba8f3bbb208d5f3a13c511c5f16c5c1daac18dfc7c118327ec2e612220a34468967d4a23585ef5c7883f55e2de5850fe10b14222daff0aca6fb2524e589bfbe82678d2e79efeb43e5", @ANYRES32=0x0], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r18 = socket$netlink(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r20 = dup(r19) ioctl$PERF_EVENT_IOC_ENABLE(r20, 0x8912, 0x400200) getsockname$packet(r20, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bind(r18, &(0x7f0000000200)=@can, 0x6) r21 = dup(r17) ioctl$PERF_EVENT_IOC_ENABLE(r21, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r21, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x100, 0x2}) 23:50:25 executing program 1: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:25 executing program 1: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:25 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x68, 0x0, &(0x7f00000001c0)=[@acquire_done={0x40106309, 0x2}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000000c0)={@flat=@handle={0x73682a85, 0x14, 0x2}, @flat=@weak_binder={0x77622a85, 0x100, 0x3}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}, 0x1000}, @increfs], 0x71, 0x0, &(0x7f0000000300)="147fbb15872613bee756705abcf3147cca5aa8ad869c32b67c011c2d8ef2982da38eac26e73eadd2744a199538a1454915b7b9cdf37aec8fab6186d217539579c7d7a566ed93b85d4a9188e5176a6945d7b5f5e09d1b79abdf89fb8a6a645e5562d5741ee2b958fc1f0faa3f8d558ea2de"}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1548.730885] binder_alloc: 2813: binder_alloc_buf, no vma [ 1548.740462] binder: 2813:2816 transaction failed 29189/-3, size 72-24 line 3284 [ 1548.764129] binder: undelivered TRANSACTION_ERROR: 29189 23:50:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:25 executing program 1: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$PPPIOCGDEBUG(r2, 0x80047441, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="11634840000000000000000007000000001f2f100a251d5e12e00000000000000000000000000000000000000070000000000000c547f2d56ddc9f449d220657c94f61ae159a713c9995f75831163b562a9449879003fc76ebe7c381c0200b13c8b7b0a4369b43c48456b9b37204fb9f5f4b23438c5e441ac7f7de984333bb0ee831f8f17360e51bb75dc696c00c45eea256cf8495309276ccf556252f80f0baa098198276ed9904a81a042f680d0e3c59c979f4d64898ee2deef5b22facd0f37e33b06594a21baabb42e344f45e05460dcfcd11f2a6968a34", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1548.789046] binder: 2827:2829 ioctl c0046209 0 returned -22 [ 1548.814797] binder_alloc: 2832: binder_alloc_buf, no vma [ 1548.814818] binder: 2832:2833 transaction failed 29189/-3, size 72-24 line 3284 [ 1548.815205] binder: undelivered TRANSACTION_ERROR: 29189 [ 1548.839305] binder_alloc: 2839: binder_alloc_buf, no vma [ 1548.839326] binder: 2839:2840 transaction failed 29189/-3, size 72-24 line 3284 [ 1548.839724] binder: undelivered TRANSACTION_ERROR: 29189 [ 1548.844204] binder: 2827:2841 BC_ACQUIRE_DONE u0000000000000002 no match [ 1548.844267] binder: 2827:2841 got transaction with invalid handle, 2 [ 1548.844293] binder: 2827:2841 transaction failed 29201/-22, size 72-24 line 3411 [ 1548.895738] binder: BINDER_SET_CONTEXT_MGR already set [ 1548.901165] binder: 2827:2841 ioctl 40046207 0 returned -16 [ 1548.907328] binder: 2827:2841 BC_ACQUIRE_DONE u0000000000000002 no match [ 1548.914520] binder: 2827:2841 transaction failed 29189/-22, size 72-24 line 3138 23:50:28 executing program 2: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x4) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @loopback, @local}, 0xc) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @flat=@weak_handle={0x77682a85, 0x1000, 0x3}, @fda={0x66646185, 0x0, 0x1, 0x6}}, &(0x7f0000001300)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x521002, 0xc) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000100)) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) epoll_create(0x3ff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffe4b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000815f00000000852a74700000000000000000000000000000eb000000000000000000000000000000000000000000856164660000000000005e7040165dab69e2da2d297feb00000000000001000000000000800300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:50:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:28 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x18, 0x0, &(0x7f00000000c0)=[@dead_binder_done, @free_buffer], 0x64, 0x0, &(0x7f0000000100)="7d3fe5b59587bf7c82a5a4ffcae9405de0ccc5f104a6fe21d92d96dbdb259c7862c39306067ee06ff0208572f3cb6b3acb01c1c0dffb20682de7514154203a0291a19b2006edc08739005cc69206dfeedfba7a69e217da767aefe016984112a2b7e2540d"}) [ 1551.748693] binder: 2843:2848 ioctl c0306201 0 returned -14 [ 1551.754581] binder: 2845:2847 transaction failed 29189/-22, size 72-24 line 3138 [ 1551.754986] binder: undelivered TRANSACTION_ERROR: 29189 23:50:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x208100, 0x80) ioctl$TIOCCBRK(r1, 0x5428) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RSYMLINK(r3, &(0x7f00000000c0)={0x14, 0x11, 0x1, {0x60, 0x3, 0x8}}, 0x14) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self\x00', 0x105000, 0x0) ioctl$int_out(r1, 0x0, &(0x7f0000000100)) r2 = socket$key(0xf, 0x3, 0x2) write$binfmt_elf64(r2, &(0x7f0000001340)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x7, 0x5, 0x3f, 0x200, 0x3, 0x3e, 0x80000000, 0xab, 0x40, 0x349, 0x1, 0x9, 0x38, 0x2, 0x1, 0x1, 0x7}, [{0x2, 0x5, 0x1, 0x3f, 0x1, 0x80, 0x0, 0x100000000}], "42b4021a037831a3b08f6c878fc99c226fe392452eab2eab67b48b65c557662c9c09ba367f9362b0396333c8817be18a4ac56d527615b2a6681166ebaf65f1ceb58597f4a75ecd4be7cb805b356419fa8032b6bb4c3f5e19c054dc0178aa484767", [[], [], [], [], [], []]}, 0x6d9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x2000, 0x0}, @fda={0x66646185, 0x7, 0x2, 0xb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1551.799963] binder: 2858:2859 transaction failed 29189/-22, size 72-24 line 3138 [ 1551.809110] binder: undelivered TRANSACTION_ERROR: 29189 [ 1551.831666] binder: 2862:2866 ioctl c0306201 0 returned -14 [ 1551.869158] binder: 2871:2873 transaction failed 29189/-22, size 72-24 line 3138 [ 1551.877512] binder: undelivered TRANSACTION_ERROR: 29189 23:50:31 executing program 2: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) fremovexattr(r1, &(0x7f00000000c0)=@known='system.posix_acl_access\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x3) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:31 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000013c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a5cca4bab1c8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bcbe5cf011e164feb2d1c05a2fec231116a85c34a7cab8f2fcb543e120fc39154fe864fcdefe12ec97f4ea9d962fe6116f2e09f14d4480d6d111ee556af450fa5d910c8a1d4cb1a03f631977e35c99cffbbfd385fbaba4403432f2c40dc682f2a531d0a46bbfe286e1a7afa90ae603c33efd4050680477cd225f1983f80080aff5e5f92070005af411f398584b67dc502c0d45be93a68a3ef2c937fae2c3a7a5f7adc6dd8d8738359cbb2f"], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1554.770819] binder: 2878:2882 not enough space to store 0 fds in buffer [ 1554.778595] binder: 2880:2883 ioctl c0306201 0 returned -14 [ 1554.778745] binder: 2879:2885 got transaction with invalid handle, 3 [ 1554.778776] binder: 2879:2885 transaction failed 29201/-22, size 72-24 line 3411 [ 1554.779025] binder: undelivered TRANSACTION_ERROR: 29201 23:50:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:31 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfffffffffffffffe) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1554.821334] binder: 2891:2892 got transaction with invalid handle, 3 [ 1554.821364] binder: 2891:2892 transaction failed 29201/-22, size 72-24 line 3411 [ 1554.821662] binder: undelivered TRANSACTION_ERROR: 29201 [ 1554.871997] binder: 2878:2882 transaction failed 29201/-22, size 112-24 line 3475 [ 1554.887747] binder: undelivered TRANSACTION_ERROR: 29201 [ 1554.891710] binder: 2901:2903 got transaction with invalid handle, 3 [ 1554.891739] binder: 2901:2903 transaction failed 29201/-22, size 72-24 line 3411 [ 1554.898605] binder: BINDER_SET_CONTEXT_MGR already set [ 1554.898616] binder: 2878:2908 ioctl 40046207 0 returned -16 [ 1554.935520] binder: undelivered TRANSACTION_ERROR: 29201 23:50:34 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v2={0x2000000, [{0x1ff, 0x3}, {0x3ff, 0x94c}]}, 0x14, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x301, 0x0, &(0x7f0000000000), 0xcd, 0x0, 0x0}) 23:50:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x6) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1557.795870] binder: 2915:2918 unknown command 1969448307 [ 1557.797287] binder: 2913:2917 got transaction with invalid handle, 3 [ 1557.797315] binder: 2913:2917 transaction failed 29201/-22, size 72-24 line 3411 23:50:34 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x2) sendto$packet(r4, &(0x7f00000001c0)="d658f894c34565eb158c575ac80542f32552d4bc37953297e9a5b895e38a7638522625bdc89e1a4c1ac10ea1c4c584207af746d8ee6ba57a2773648e5b298a000912d129b6d2952c388213ba714db7e1aff52dffefac604d9446", 0x5a, 0x4050, &(0x7f0000000240)={0x11, 0x4, 0x0, 0x1, 0x8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) rt_sigsuspend(&(0x7f0000001340)={0x3f}, 0x8) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) fsetxattr$security_smack_transmute(r2, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f00000000000000000000000000000000552a00000000856164660000000000000000000000000100040000000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64]], 0x0, 0x0, &(0x7f0000000640)}) [ 1557.797669] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.821490] binder: 2924:2925 got transaction with invalid handle, 3 [ 1557.821519] binder: 2924:2925 transaction failed 29201/-22, size 72-24 line 3411 23:50:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1557.821870] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.870994] binder: 2927:2928 got transaction with invalid offsets ptr [ 1557.871022] binder: 2927:2928 transaction failed 29201/-14, size 72-24 line 3330 [ 1557.871433] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.882145] binder: 2932:2934 got transaction with invalid handle, 3 [ 1557.882174] binder: 2932:2934 transaction failed 29201/-22, size 72-24 line 3411 [ 1557.882489] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.967240] binder: 2939:2940 got transaction with invalid offsets ptr [ 1557.967272] binder: 2939:2940 transaction failed 29201/-14, size 72-24 line 3330 [ 1557.967903] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.988640] binder: 2938:2941 got transaction with invalid handle, 3 [ 1557.988671] binder: 2938:2941 transaction failed 29201/-22, size 72-24 line 3411 [ 1557.989091] binder: undelivered TRANSACTION_ERROR: 29201 [ 1558.053747] binder: 2915:2918 ioctl c0306201 20000100 returned -22 23:50:37 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) signalfd(r1, &(0x7f00000000c0)={0x5d}, 0x8) 23:50:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000200)=@buf) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x20ca1, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000240)=""/1) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ioctl$PIO_FONTRESET(0xffffffffffffffff, 0x4b6d, 0x0) write$evdev(r3, &(0x7f0000001340)=[{{r4, r5/1000+10000}, 0x3, 0x3ff, 0xd7}, {{0x77359400}, 0x1f, 0x101, 0x80000001}, {{0x77359400}, 0x12, 0xfff, 0x8}, {{0x0, 0x7530}, 0x17, 0x1e4e, 0x9}, {{}, 0x0, 0x0, 0xb6c7}, {{r6, r7/1000+10000}, 0x14, 0x6, 0x4}, {{}, 0xf6f35169627d5643, 0x100, 0x9}, {{r8, r9/1000+10000}, 0x0, 0x9, 0x4}, {{0x77359400}, 0x5, 0x6}], 0xd8) 23:50:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) capset(&(0x7f00000000c0)={0x20080522, r1}, &(0x7f0000000100)={0x3, 0x7be, 0x3, 0x6, 0x5, 0xe134}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1560.809049] binder: 2950:2951 not enough space to store 0 fds in buffer [ 1560.813765] binder: 2949:2953 got transaction with invalid handle, 3 [ 1560.813791] binder: 2949:2953 transaction failed 29201/-22, size 72-24 line 3411 [ 1560.813954] binder: undelivered TRANSACTION_ERROR: 29201 23:50:37 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR], 0x0, 0x0, &(0x7f0000000640)}) 23:50:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x4af) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"/4088], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1560.827468] binder: 2947:2955 got transaction with invalid offsets ptr [ 1560.827498] binder: 2947:2955 transaction failed 29201/-14, size 72-24 line 3330 [ 1560.827878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.885232] binder: 2950:2951 transaction failed 29201/-22, size 112-24 line 3475 [ 1560.895797] binder: 2962:2965 got transaction with invalid offsets ptr 23:50:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR], 0x0, 0x0, &(0x7f0000000640)}) 23:50:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1560.895826] binder: 2962:2965 transaction failed 29201/-14, size 72-24 line 3330 [ 1560.896308] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.905281] binder: 2963:2968 got transaction with invalid handle, 3 [ 1560.905306] binder: 2963:2968 transaction failed 29201/-22, size 72-24 line 3411 [ 1560.905753] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.948243] binder: 2976:2977 got transaction with invalid handle, 3 [ 1560.948268] binder: 2976:2977 transaction failed 29201/-22, size 72-24 line 3411 [ 1560.948683] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.980155] binder: 2973:2974 got transaction with invalid offsets ptr [ 1560.981272] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.992840] binder: 2973:2974 transaction failed 29201/-14, size 72-24 line 3330 [ 1561.001669] binder: undelivered TRANSACTION_ERROR: 29201 23:50:40 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:40 executing program 0: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) sched_getattr(r0, &(0x7f0000000100)={0x30}, 0x30, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xe1, 0x0, &(0x7f0000001300)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000800000000800000000000068000000000000001800000000000000bf13bc116dd24fbbc337d2bf20ef66e254ddc0e198db7b14829cbd4e46558af7819d33713d2c5150b3b2023520d5b6ed948630780a0cd91a1bcf18897982d2112c88a98aefd8021b7acac8f4b36caecb75b399f2eaf308002265ee1b572abc0201f94ce4842ee653d8680e5734d10cc5096edee0c97618b2f00bdeaa2dbb48fd717e7124664ca536d3ab1565f600"/209, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f00000000000000000000000000000000000000000000852a646600000000", @ANYRES32=r2, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000028000000000000005000000000000000e2a50c60a4b0d983000000000000316e6956fb0d93d772c70022c6aca123d50d5ab51ac2ccb48f"], @ANYBLOB], 0x0, 0x0, 0x0}) 23:50:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@empty, @in6=@rand_addr="9d2cc7b6727a614069d7bb25b65f62e7", 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x32}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x0, 0x3c}, 0x0, @in=@loopback}}, 0xe8) dup2(r1, r2) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR], 0x0, 0x0, &(0x7f0000000640)}) 23:50:40 executing program 0: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1563.826694] binder: 2981:2983 got transaction with invalid handle, 3 [ 1563.837263] binder: 2981:2983 transaction failed 29201/-22, size 72-24 line 3411 [ 1563.842140] binder: 2979:2988 got transaction with invalid offsets ptr [ 1563.842169] binder: 2979:2988 transaction failed 29201/-14, size 72-24 line 3330 [ 1563.842437] binder: undelivered TRANSACTION_ERROR: 29201 23:50:40 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, 0x0) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r4 = inotify_init() fstat(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r3, 0x0, r5) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r5, r6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@exit_looper], 0xe9, 0x0, &(0x7f0000000300)="60dc3212c8f3e9f2f75bfd3af6a09b6a40aceb91a09f8cd67e0f5944b37b9b38d7f68a1c69280aaa8660a59959e208240cf21234e18b4f0128c2d540e53e7a64fd38d14f9a9da9359d3b58e2b9d2b87c151550cee10b9aec0b758a8712b5fac8a4b2181aa04f2f46294bf3d7f03a028053dd3a31987398fe09aa8ab6d290ff26d36a399f06e9f1cd600d8afa7d31a965171a6eb8038d5450c905032753d2fb80a71e2a00615f11ac13cdef7e988dbeed31183b6ff7f5a743417cca0c97044b6c99a233cc267d691ddc9c9631712768172d237fd87e9a2869bd4ca1442e5c71b0e8b8a2402384219a46"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a747000000000000000000000000000000000000000000000000000000000000000000000000085616466000000000180000000000000010000000000000018000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000529aab807cb0403e50106806aa08d295f67cbde8c1660166dc6a675552d9a42a200f91feb8b45892c01398950f1009d375e2b850c1f00c74a86614110fa321db46ae86"], 0x0, 0x0, 0x0}) 23:50:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 23:50:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1563.873688] binder: undelivered TRANSACTION_ERROR: 29201 23:50:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace$getregset(0x4204, r1, 0x4, &(0x7f0000000140)={&(0x7f0000001340)=""/4096, 0x1000}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x39) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) write$cgroup_pid(r3, &(0x7f0000000100)=r4, 0x12) tkill(r2, 0x15) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a0000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f0000000000000000009fa0311f00000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1563.909096] binder: 2994:2997 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1563.927775] binder: 2996:3002 not enough space to store 0 fds in buffer [ 1563.927805] binder: 2996:3002 transaction failed 29201/-22, size 112-24 line 3475 [ 1563.927880] binder: BINDER_SET_CONTEXT_MGR already set [ 1563.927888] binder: 2996:3002 ioctl 40046207 0 returned -16 [ 1563.928024] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.929829] binder: 3000:3005 got transaction with invalid handle, 3 [ 1563.929856] binder: 3000:3005 transaction failed 29201/-22, size 72-24 line 3411 [ 1563.930032] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.001338] binder: 2994:2997 transaction failed 29201/-22, size 72-24 line 3379 [ 1564.012195] binder: undelivered TRANSACTION_ERROR: 29201 23:50:43 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:43 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000000c0)=0x5) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x200c02, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, 0x0, &(0x7f0000000340)) r4 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000820}, 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYRES16=r4, @ANYBLOB], 0x2}, 0x1, 0x0, 0x0, 0x4000}, 0xc490d273bf9eb065) sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r4, 0x100, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4002) 23:50:43 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) [ 1566.851170] binder: 3013:3016 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1566.859798] binder: 3012:3015 got transaction with invalid handle, 3 [ 1566.859826] binder: 3012:3015 transaction failed 29201/-22, size 72-24 line 3411 23:50:43 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:43 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) prctl$PR_SET_FPEXC(0xc, 0x20001) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1566.860234] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.893389] binder: 3024:3025 got transaction with invalid handle, 3 [ 1566.893827] binder: 3024:3025 transaction failed 29201/-22, size 72-24 line 3411 [ 1566.894216] binder: undelivered TRANSACTION_ERROR: 29201 23:50:43 executing program 4: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80, 0x100) execveat(r4, &(0x7f0000000280)='./file0\x00', &(0x7f00000004c0)=[&(0x7f00000002c0)='/dev/binder#\x00', &(0x7f0000000300)='self\x00', &(0x7f0000000340)=')vmnet0,\x00', &(0x7f0000000380)='F,\x00', &(0x7f00000003c0)='\'\x00', &(0x7f0000000400)='/dev/binder#\x00', &(0x7f0000000440)='%\x00', &(0x7f0000000480)='ppp1\'system\x00'], &(0x7f0000000740)=[&(0x7f0000000500)='/dev/binder#\x00', &(0x7f0000000540)='ppp0proc&\x00', &(0x7f0000000580)='/dev/binder#\x00', &(0x7f00000005c0)='md5sumvboxnet0eth1:procem1loppp1\x00', &(0x7f0000000600)='em1vmnet1md5sumproc.[/\x10\x00', &(0x7f0000000640)='/dev/binder#\x00', &(0x7f0000000680)='/dev/binder#\x00', &(0x7f00000006c0)='/dev/binder#\x00', &(0x7f0000000700)=',eth1\xd6\x00'], 0x100) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xf0, 0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="03630840", @ANYRES64=r1, @ANYBLOB="096310400100000000000000000000000000000011634840000000000000000000000000000000000000000001000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="8561646600000000020000000000000000000000000000003d00000000000000852a687700100000020000000000000000000000000000008561646600000000000000000000000001000000000000000900000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00100000000000000c63000006630440000000000d6300000f630c4000000000000000000000000010630840000000000000000011634840020000000000000000000000000000000000000002000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r2, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000130000000000000000852a74700000000057d56b2006a473767ec9195d415bf7f01685", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000001340)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="0004000000000000106308400000000000000000"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x5000000000) [ 1566.948602] binder: 3033:3035 got transaction with invalid handle, 3 [ 1566.948632] binder: 3033:3035 transaction failed 29201/-22, size 72-24 line 3411 [ 1566.949047] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.978299] binder: 3030:3034 not enough space to store 0 fds in buffer [ 1566.978330] binder: 3030:3034 transaction failed 29201/-22, size 112-24 line 3475 [ 1566.978757] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.022965] binder: 3013:3016 transaction failed 29201/-22, size 72-24 line 3379 [ 1567.036945] binder: undelivered TRANSACTION_ERROR: 29201 23:50:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x50000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffffffffffffffb6, 0x0, 0x2}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x22a}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x51, 0x200047ff, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x22, &(0x7f00000000c0), 0x4) 23:50:46 executing program 4: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:46 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) dup(r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1569.876416] binder: 3051:3054 got transaction with too large buffer [ 1569.891584] binder: 3051:3054 transaction failed 29201/-22, size 112-24 line 3493 [ 1569.910181] binder: 3052:3056 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. 23:50:46 executing program 4: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000001340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f00000000002dc8a600000000000000000000000000000000008561646600000000000000a517000000010000000000000003000000000000002eadda9c174d56bc866f071ec3eb549b40209a083df1e0780fb2b3b0fa8a6f066088331915051b9551c804944e9a03dbcf951d9f601bb393933278cad759da67087d113b5fe7d68e421494bd978c792110f6eb14458357b581e26f059f8a417f6a6ed12ceeacbe98eca2c02553b0ad91920b4f3135c356d6f65cd46a1711f65eb0094c0423bef6497ceca739739ebcfbef946447809fca6f9509b2d6c81a67cee3ea1182a46d6cf344f0c3c5f5701854a49789fc8e8b8bcf35399c7000d82d616a299caf02"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x0, 0x0) utimensat(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={{0x77359400}}, 0x300) unshare(0x400) 23:50:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = syz_open_procfs(r1, &(0x7f00000001c0)='stack\x00') mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = gettid() preadv(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000300)=""/4096, 0x1000}], 0x1, 0x9) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x39) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x2, &(0x7f00000000c0)="d34ebd58e30c5cd673fdf7b6a437eeece522005cdca4148e09b0792f3d75d3a125517f9474af0f7aebf70f9c3be391f69d840ac7a6dacf8bce82de10232062ca916e1ffca56607fa72079b3d1676b62e448569a8b4f0a05a514cb10d932ea10b3694afe6a6ade31a52fa98f288158e360a5903fea4539b") ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x39) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) ptrace(0x8, r4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:46 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4085, 0xff5, 0x0, 0x3a}, @fda={0x66646185, 0x0, 0x1, 0x1c}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) [ 1569.924789] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.934951] binder: 3052:3056 transaction failed 29201/-22, size 72-24 line 3379 [ 1569.944382] binder: undelivered TRANSACTION_ERROR: 29201 23:50:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x3}], 0x0, 0x0, 0x0}) [ 1570.010579] binder: 3074:3081 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1570.010738] binder: 3078:3083 ioctl c0306201 0 returned -14 [ 1570.044400] binder: 3074:3081 transaction failed 29201/-22, size 72-24 line 3379 [ 1570.054517] binder: undelivered TRANSACTION_ERROR: 29201 23:50:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x200c02, 0x0) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0xfffffffe) preadv(r4, &(0x7f0000000000)=[{&(0x7f0000000080)=""/68, 0x44}], 0x1, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, 0x0, &(0x7f0000000340)) r5 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB, @ANYBLOB], 0x2}, 0x1, 0x0, 0x0, 0x4000}, 0xc490d273bf9eb065) sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x84, r5, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffff9}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x7fff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xa5df}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'teql0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xe5bf}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x900}, 0x4000) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$sock_inet_SIOCDARP(r3, 0x8953, &(0x7f0000000380)={{0x2, 0x4e24, @multicast1}, {0x306}, 0x20, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2a}}, 'team0\x00'}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 0: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) tkill(r0, 0x2e) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:50:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 23:50:49 executing program 0: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) dup2(r1, r3) [ 1572.894071] binder: 3092:3094 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1572.906787] binder: 3090:3093 ioctl c0306201 0 returned -14 [ 1572.915442] binder: 3092:3094 transaction failed 29201/-22, size 72-24 line 3379 23:50:49 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x3) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='/dev/binder#\x00') ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) futex(&(0x7f0000000100), 0x1, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f00000001c0)=0x1, 0x1) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) lseek(r1, 0x7, 0xe8293cca49b64966) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair(0x8, 0x2, 0x8d, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000240)=@ccm_128={{0x304}, "0d197fe26f577e6b", "dc0ada96388b8c30b1506989adad917b", "00e8e227", "e3c3ef25ee52734b"}, 0x28) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000016e5a7f031c66834d2311ba5f81d221135af9a2cf83910d4f3bb", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000b5439d4103f2da490000c1c2af918d2c4174e6a8d818ce005000000000000000"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffd93, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="266304400000000b6300"/20], 0x0, 0x0, 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_IRQP_SET(r2, 0x4008700c, 0xca1) [ 1572.939952] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.945419] binder: 3103:3106 ioctl c0306201 0 returned -14 [ 1572.977044] binder: BINDER_SET_CONTEXT_MGR already set [ 1572.983284] binder: 3109:3110 ioctl 40046207 0 returned -16 23:50:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) [ 1573.017291] binder: BINDER_SET_CONTEXT_MGR already set [ 1573.027259] binder: 3116:3120 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1573.027288] binder: 3116:3120 transaction failed 29201/-22, size 72-24 line 3379 23:50:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)}) 23:50:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/4091, 0xffb, 0x0, 0x10}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1573.027681] binder: undelivered TRANSACTION_ERROR: 29201 [ 1573.060781] binder: 3132:3133 got transaction with fd, -1, but target does not allow fds [ 1573.060815] binder: 3132:3133 transaction failed 29201/-1, size 72-24 line 3427 [ 1573.061172] binder: undelivered TRANSACTION_ERROR: 29201 [ 1573.100173] binder: 3136:3137 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1573.100199] binder: 3136:3137 transaction failed 29201/-22, size 72-24 line 3379 [ 1573.100566] binder: undelivered TRANSACTION_ERROR: 29201 [ 1573.146940] binder: 3117:3124 ioctl 40046207 0 returned -16 [ 1573.154802] binder: BINDER_SET_CONTEXT_MGR already set [ 1573.160247] binder: 3117:3134 ioctl 40046207 0 returned -16 23:50:52 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000640)}) 23:50:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) openat$cgroup_ro(r1, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) write$apparmor_current(r2, &(0x7f0000000200)=@profile={'changeprofile ', 'pids.events\x00'}, 0x1a) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000400000000000000000000000000000000007000001e000000001800000000000000e8ad30", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r5) r6 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self\x00', 0x1, 0x0) keyctl$chown(0x4, r6, 0x0, 0x0) keyctl$get_persistent(0x16, r5, r6) 23:50:52 executing program 3: r0 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x40, 0x80) accept4$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev}, &(0x7f0000000140)=0x10, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) gettid() ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:50:52 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000640)}) 23:50:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x402000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x35, 0x0, &(0x7f00000001c0), 0x29c, 0x0, 0x0}) [ 1576.012200] binder: 3146:3151 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1576.027031] binder: 3150:3157 not enough space to store 0 fds in buffer 23:50:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000940)={0xec, 0x0, &(0x7f00000007c0)=[@release={0x40046306, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x11f, 0x2}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/160, 0xa0, 0x1, 0x30}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x78, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/143, 0x8f, 0x1, 0x31}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/143, 0x8f, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/63, 0x3f, 0x2, 0x27}}, &(0x7f0000000540)={0x0, 0x28, 0x50}}, 0x1000}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x6634b698f5c2d852, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/186, 0xba, 0x0, 0x38}, @flat=@binder={0x73622a85, 0x110b, 0x3}, @fda={0x66646185, 0x5, 0x2, 0x11}}, &(0x7f00000006c0)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x1}], 0x7, 0x0, &(0x7f0000000900)="71c8d30a5d1d89"}) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000980)='/proc/self/net/pfkey\x00', 0x10000, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x23, &(0x7f0000001340)="f2f1a701bd477d42633b44025cbc11d6fb51f75e42e1e8b2f01d0fc6c08fd34146623739b769a50349beae429b40683e561acc1febf07a80107a317b6ea5ca6b3f1f9aaea95787b5dbd81ad6c191524869397ed3d88949ba2c407437ace7a0a398da14ca93644491e84fe846cd891d7d5f88d6e6d9e03851bdfdf2b21d482427009067425f48fd29b86b0107e1d2398116e956b379fb77a37ebe32d85a4715f1cfaa9f91eb4c009d5bc0e69930df55a83533691672316e2d3239ae9303b75d4531ee9f3f17c99c3daf7ade4f7de9a217c2d055c0e8740a430e0e6bc090a9d8e4bb0b89fe40b0abcab8351e80834c880cd6c959f22448156d2c8c96df5b3067feb6891c1a6db8275665537add4aaab65677c9b60be52db09fe241bd14751afc1e9021a96682fff296d79b28026e1f6f545d33c23049be58f6f9486a0ecd2a6b5f91a05e8988a8b81f0718cb2a7bab96e0357d792d84064c172761dad095df16838f9a50b7cb069ba0a91adb1108eb4bd3003aa6938055d0c8ceddd37d429c0bab642cf018fdb48005fa4565b9f200a0c0c0ab4123d7b9de95fbfe3f9bc209110eb1fcc586baaf77bfaa67c82750fd6f0f2bdd799e900dabcaf27b296ff48cad5e0550a9fbaa2694acc8da074d315f1f0bc653ea1d8c7828f6f0134f328e5920dbba36145be78eb97920bad03af14ecd05e3d1f4ab179e624dc9c35fac81811f85fc2c3b7c5ad0916f2ff3a38a07ff35c4901c85fcbcdd246990f31c24b3a20393d4e0485c5c49f132b3d9ccc6601ed6e1e2b65f1a10c219f624558d53c1769138286890dfbab78f85e01440749e1c53fe91a3bdf9503037b353ae185a03e8bc89d2dd7e37750249af526c63368ca7b512d587f99299b4b88cbeb8e19ba1dc2c913638745dfd25581a867d1f6ebeaadb61c5304cdb09783590802bc0d35ebc6cdfe05a5aea7a5f6eba6d15d5012d14527b4830d09e0f046aa3001f9f740ef0a007ea40a70d02d59e931adac2f6f8120a0de6dc3783dbe37752aaba8c25955687209c2e96496689a1e161f21b3005c8da36c410ea8e565f32373753922b8107409caf8263e0f8173bbd0daf5d8f8bd72a55b86543adadc9fdc3a9de87a741654567b32f5b9cc5591bd4e46f439a0e55b9c5642aa130d1678dff401e995d70380291ed6bb49fcbbc8cd22b43d611a04a826802825ab527cf25bc1277f39ba4061b0987aebe2bb177879c07cd8c6205b93f345388e8646426a12cf11080d95088c646337fed7b918b4b8f28e7ba4fbb11308ac5f868be1c551b5262f18bed982a096d0124bad484c1973ca94b553c7ef59da25c5a88dff1c677961b47e56be04398e11698e89ba4aba413bddb30a7605ac4a14290d32762d39d6d71ed58059303bd6f39d7f434385ce971970f747f26351747ccdd516d03451f9cdfa18ddd3a16d78c328a97a43ecd1edc9e007ae228f1166b7a2920f4eda4e22d39361e521c393530a66261edd34275c59eb02bb80761700cba9d4de715ee4f0be733a1d2f42e3174fb798588bf8ae0adb910598bab3e3de663e217cb3d2d0956968aef5893c0cf7f953dfeb585b93f54b0b602fb9ad9cbab250daa7a09d6e1179023f24005084d14159be545ad56585505bed6e1f7276aa8fc9299fe3eab8170e5b53a7cc54d4959f255d82276acdafc66a3652a0aec289b11bf1d0b05bb74eaebc1a659243b7f6f7fdb91fee13b76c9037f7d721296556d68102b81505d3762cc9f76d2848debfad9b7eed14dbbed24ea905b17af6f6583a086b3fdac6ded699d58e2d23b9215f7a127c8cccd72ff8cb2b4a2baf28c9220bc0228a7a9a8701efb3d7488d3c9f801ac213623c98c37fc08fb2d176427461c0cdde53dd14b941f802ad5c00e8e810d3a50e6b371b7cfb0fd0264a69acf64f684e507dce8f1c117004c3cdb92ebdaed68c6c20fe279eb1706f41a7b2fbd1588e5d8ebac7f827de832375d4361e0407edb80aa70d324aac586d3be0096bfcdb23fb6cbb7ad3a5698749f1b4719fab85714b03265bacb7dadb3bcc6dbc748b54cdb4d0bfff29b68ed745a3e093025f5b049cfeacf838c587bb87724ab13646fd2f86840f624836868da8358cefad8dc89ed568cbc0c9bed5f4986ee32e3b517b0f242750a26680d5015757ef441b9dd66a75a5a37bf43aa96b5f29460c8d93472512a06ba9344091ad3981f83fe8a6ea9b9a59ecd534dbc2efa2ce5d5e2976a3b91804999f667f9a8e96000c01a229680f301111d99babd2c2ff4a9fbf626d54eea8cbeeaf89054af528be09fbd725c96801c8a45a907ce5f177a2e65cca957551689bbb0b3c4a6254e254637b565eebceb46c6bfeef5481b995ef065a4d2ecfb1b2968bf5f233091f927a6b32ec733c92bc43f8b418de810a9ce2ac68557e01b392b7c6f93c4211438a314599b96c84a89da0390b931f018a37656d9e3fbd11bbdf44af4a564a4e89faab82ab46178856eddadee4d7cd86d26b16550f56481d81c8754ca678d0cd2158402b47f2d0e0a06cb65ebb6016574f37b9f88e06a55ef26c56660f3332e95585c4cb99b4848b44ee328e7f5090e0c9a510a321954f8d7b9e426ee2a8ab088cd71ff6962ce9143f27f519654e48ce3394577b02f80a63606a7ffbe8b87245a8411c7e58e0c1d7775b3598b5cf81c0664f546d22c50921999a9c333ee1a26c99d8c03012ec5aa03774cac853cebc1af207b3cab5efc81fb99d084970a8315c8466e1efff326df274b01dcd9762ed32e945dce408293bdb8af33a1277c02a5e85ce5a9bcb2604449e2fb3b5fe97fdb2708521f4417b11fad2374868213361a235001bab7b92479ad9c67651e184f292abb5eab4ee98113b73b39955a29a3144c0d41f87e4aaebb96894eec0f95e53abf8fdc60c9fd3579e95811ca57871feed9ce3285d0aed61a9ebe1194e9ed4bafe60d7d075f1d0b1a401c8eda4c6a5d72e890f220040bf6dde52d45a1328a17eaf90fbca3e31e7a7f8486688a77ff6134a259b839b9690de64e9161debe02351dda4d187290bec37e6fa17c6decd06512f09e8478445d9af94bbe37771681ab4920f68261e69898013c83c0e5a3ec3594ab0f213b57cef47c75fcaaee1d52c7af44bcf06a1525c974cab309ebd56acade26ba75fc8bb3df293ed439784a2f4a62bd638a4a766609b55ad29dacef2490a4294c4e8ad4aa066d0af4e93375775b51b38140665f89a62094d60526c44149e123526211da151c4b3f7c7bc5d6e811b3be1b37077dd62bcaf5c206be80d3b6f97363a436fc60c58002c35ba2848978389250240b69cb7ff2d8930905394d91334f91c5a7bbc09590881eca7c27c843cb9899f54215698dcff96c820f09c096eaff7e127123102d84864feb54417965d6281df9401a24befc0d13f7c2d1f230ca763699d10dd80777cd53c96362f6df71ad42a8b692985671b32fe426a1a131341791f5ecc3b52adcf4bcd55739877819cef087d16bd7752b831cfc697aa57622335584d6f8214340ea7d0c9548cd86d0421b004829db45f8c3e8986d676555140049678c793c100d2ca77e23e8dbe53fc5a489fae8d02b0106db78813ef98c239722a0405a8568cd6b96b3de9df31578768020a3946dd2d4fa721da342d98dfa10a4c4f4bade1b74acf0fd65a7ffafde01c582e84dad8073a3774addb5baa49b88930adbc58d452c8e3ff8271e8977bcefad3d13903dd44dccc2b325a6cbdd90d8d992748dc3252358475991a5eefb5679dcdedb6f588916dd981a43db61673fa45ba2c9eff03e5dbb1ea8e0af1da217d8f33ef9ef19f347935b2d16cec068c8019f62adc288763c9ff8d016b1b98c2b43d435d80b3d35ae625c464c579bbc1a72862a413b79bec3bce5fbbb6bafc3516f4cc81495bba0b2e266eaf966ade0776fc79444a6c3d590b6fb5fafee12af750b82ab4d25113d4c91ed8d210f1e6f904fe6e0e0c9dd4da1feb1ca96d306a8d0e0878cb56524fa32807482884867d13b32ec7dac56739711a933ea68d28c3b4a5d9bef3b5ac39376464a9ced8937a4d82a504f5792531b8b678dabbf55100b571dc9fa6a656badda029466bd69686b9a0e51bf1729ad8813ca4887890db77f9cab10e10f4ab88d1ae55e06da655be86eba1d12db3c34d98cda383a9ecd5399fa8fc9660b956ee216f1c424e22e4150f2a99d9afaba84aa7b655ed855de118b0062f6e278174f576fa92108d9d748a38ca9554558e938c2bcfd4eb088c6bd71e5386bc74465fa75cbd6b4a8cdae9b7a3987091ed5ec9c336d05acca4cf0451f8db9187d27ddfc3588bf9a2101501f46c607016f6f034fee31086645c6a988373d81d6b84cb73e08d1befa1b443b4a28dc26645e84d7a865e5af8d0aca56cf3814563234a6889b6b5af941a052ce28a13b94c42768776bd1c01dc46d85c86e76697db34b3827be542266df0eeab8e134a379bd0a54f0cd381971b67204b07ee0e11b2ff45484fc818285e8ebca639bb28f406f049bee652c3a0be3c4adda1439ea343d065f88bda87c042416f05871ef228d9aa52c99da9b7156eaec426ba6fd40a0e6b12b378ed2763e19837f20bca163daf46a703b3c72b0b702b3adc8d29f1d688831b4b1734fa05418918ce92efc1640da35b634a45830ea7e9558ea50b3522dc5020defdfe3c7c833c2980c590d202d1cc63faf5338d48090b1d3badd4a8a9b3dda7aad38fd518d4fb39d6265a3a9c3ab18f4c57601c5b7b9b586f4fe9b9829ee78f340775b474c9a8770783747a8dbeb77da6a5d2b225558f08e647e9dadbe40124c7ab4b862aeaae67da338ffc5505e941415756052d43175e1f061b2142b06737078eb00b98ef33ebb6b82ba13cd99db4ac71b0d2ab67050be569ee60f2a2fab5f5f81dc7385a7d04de57eec643a839499b3a4480f0ab0e46b0064c90cec88040a9847b49e05bda756aad6400b925ffddbd8c0a19dbfc6a391369f584c73bb04b528c956570fbedd1809b140593b7a636de98a0029d88eb65fe082288be0a7e6ca2517ba49f50e60c3993b425cf0c8c0bd92995b4925a189a1aa985a6f171094dd8f07c3e1f6896a881c5d69f4dfe095c3b36ff4fb9f3ed7795ad44adb158bef7dee3a42d8795f8663226e3722a247c4658f73e461f316e678b597c501c1591254d79fe5ebbc775941aeab45a5ae2eaf159c68e6c1c9f3718f06da75809c08ab4c531e461e4def76b02b193ed879898a4a18ddd0b04798be958ba4961146024064e63376066c57c21fe6f8da7bd4529822ca3042f937f32d99bc5be76a1886bcbc5808c7afef189a9d4d350743caf6dcf4d8d060255478c157d48bb85c3b86b482d75a432785aa90062de82f99bc7857f21b5504613bd36bb72d439b749642daec2b9107044eef7e0fd0cfa4b62685d37fa4c0891133e251cc69967ce242a2f3f84b640f9a62a920a95e4bfc34638280d01a01b87be4aa37335bbb7ad17c11954736020f491331cbc1a756eb8bb64a412421466b2c570eb771b4d5c165e8a554b344733aad94b6aff3d1c3b8f21d8799c2a80f74667c6e4a131ef835e0e288a95c4e99ba73107c91d4f4aa84392cb4fc70c254e3fdd803756aafc6b267c7f17ccbc174251c4ace0937ccd34d72fcbddcaac11255cb5f5ce6269d84a599bbe69e13d78293f0a41e70d0d1bc2138c9ac9ad231b95b9be064fa8bfeff4933493d6655dfd98aee1993342dd98f9e86f517d17c9de585fa97d569e7a414f859c967d7b673f7c889090b21503519a8d6f82bdb8e9073a011b4", 0x1000) [ 1576.027058] binder: 3150:3157 transaction failed 29201/-22, size 112-24 line 3475 [ 1576.027214] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.089224] binder: 3146:3151 transaction failed 29201/-22, size 72-24 line 3379 23:50:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000140)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000001340)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000eee4d9db0c2fcacf5c", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f0000000000000000002e67970000000000000000000000000085616466000000000000000000ea9afb5d31fb00000001000000000000000300000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) connect$inet(r2, &(0x7f0000000240)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x200000, 0x2) write$UHID_DESTROY(r4, &(0x7f0000000200), 0x4) r5 = dup(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) faccessat(r7, &(0x7f00000002c0)='./file0\x00', 0xa, 0xd00) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400202) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x4, 0x1000, 0x81, 0x0, 0xe}) 23:50:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f0000000640)}) 23:50:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000640)}) [ 1576.122570] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.140936] binder: 3170:3172 got transaction with invalid offset (87960930222080, min 40 max 112) or object. [ 1576.165091] binder: 3175:3177 got transaction with invalid offset (7955998172716033071, min 0 max 72) or object. [ 1576.165117] binder: 3175:3177 transaction failed 29201/-22, size 72-24 line 3379 [ 1576.165338] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.241961] binder: 3170:3172 transaction failed 29201/-22, size 112-24 line 3379 [ 1576.261623] binder: undelivered TRANSACTION_ERROR: 29201 23:50:55 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000640)}) 23:50:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDGETLED(r2, 0x4b31, &(0x7f00000000c0)) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="116348400000001323b2ce0000000000000000000000000000000000000000000000000070000000000000001800000000000000edaf4cfce218b77313e554477129c9aa8e01868f015fcb06904495f0cd3f94c96cfa451bda7f11c224cb36e2d285ba0581e608000000bd288edb8b1e696a6ad216d0f1ba9a0d5a275441d73bd0a192a37021ef32afb14d6356c5626a2efe1f403ea8ef91fdc684dd9ed6594a23da7d6178c94809c8e3bdbd4b4ac4e2f82690b78dd6639d36fbc29836ca2aab25e0", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:50:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)=[@clear_death={0x400c630f, 0x2}, @exit_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={@fda={0x66646185, 0x3, 0x1, 0x16}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/102, 0x0, 0x0, 0x22}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000240)}, 0x1840}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1201, 0x1}, @fda={0x66646185, 0x9, 0x2, 0x34}, @fda={0x66646185, 0x5, 0x0, 0x27}}, &(0x7f0000000380)}}], 0x2fd, 0x0, 0x0}) 23:50:55 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000001340)=""/4091, 0xffb, 0x0, 0x1a}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f0000000100)) 23:50:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000100)) r2 = fcntl$getown(r1, 0x9) r3 = getuid() r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x39) ptrace$setregs(0xd, r6, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r6, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x5c4, 0x1b, 0x800, 0x70bd28, 0x25dfdbfe, {0x1c}, [@typed={0x70, 0x33, @binary="6db3f522fc6f29a7e35e288e290335bfbc19d2de4c81528c1e208c6e5e4bbb54647c42283f2f740ee2fa8a0c08abe6a5e5ac25b78a7ee779f47a6b396376406f687a1b89132c3c6d3d225cf32670e3c79a7a2042a8b832f6fd39c7df0a3406d616eef6fd0728ee440cc4cf"}, @typed={0x8, 0x8b, @pid=r2}, @nested={0x2e4, 0x4e, [@generic="8c36f325e33d25ccae0909cef723bb708993b428d4d84d732017db8952ed6272684c0e40104e277bc40effc560e8f4816c167806dc577568cf2892860bb23b9dc88a226d2dd7acfcdd3a9eeaa7785a9fd3cb1ed81a6d1c2a184e807d15773f97f06c4b715c1cdd3177e56799fd67a1035af26be03e5a7e50b96bc82deaa44997814a3dde3f83a9dec9abe450c5b9a6975ff6237e81a1eb30ec5b1a18a20c429d9f07b35325cbef76556fe062b0831de59e65cd6943ad6bc2556e08e38394a431dd66dc16edb49d395b97c676f5b14fc9bbf3aeab4a21d693f03a54a13bda8120efc2ca369f4fb346a3b542ed2673dcd72655ed24fdf518cdf06c62bcef30f1", @generic="e927c3224624b0de8486dbf12d4a80746611b42047b3b98ec2c9bd7fbf4f800e907997e8ce58c0e812178042dac5cba150ccd09e3169c4839ca5a1741c8fb6dd3688757081a4406a03f7bf03e32e2910bae7c1636322a468559f74d9871e058c3431120c20d861824d69173defc2e4067a6f2327e3a9deeb4e5c3ecf9281b2d16c", @generic="73a04bad6f3682d92b052ef3106492663b303980e662c5e52c8f68073ada2eca16d72a5332d3dd568d2c7b87e40ad95d7bef9011e754e90fe93b478e09588f0f884f67f2727de1cfeef8f4bbd149c9e2d699a9853fa9d51d3f79ccf1b36bc41dff231542c773c1", @generic="6cab172eb2e177f27618c325e8b07fe5820cfad2d123ada34cd7e556365b6a54b022f051a1dfac5a51ed4cc2a938e453bb643c018cd463f06ceb85c002855fca8486e4a6688ee6d581af2c1edb507688b4e378d79f75cf462fb5217cf5c89ea7526efbbb745794237fa5e2bc6a8c026f651d359d25e630112cae374dc2304a11b1b9b508095f7f41ef3c0ca05779af570ff3468abe4ba3a8b8deb1af453251ff972ad8480996cf42c9dd337be8be76f48f51603d3c3f62186bd76b8eda2084005a87df54474af42f25abd0484b1dee7d99c7f94126b68ff2d4f8aae5bc8a12", @typed={0x4, 0x52}, @typed={0x14, 0x26, @str='/dev/binder#\x00'}]}, @typed={0x8, 0x40, @uid=r3}, @nested={0x17c, 0x13, [@generic="e9e620fe3cf9a158cd62577b73a906961d4a50753d803ce5021154ba69ebdb8c47bb8c39de063e1807f117634173f901a046690f86226267532bc18dc09b83a64f8c4ebd83f61bd58a8bc49d5292b8279ddda20775cdb843c0b2927111ade60280283b95bedd", @generic="02042cbeae97d683e4cc2fe9be6c99e99fee77f4cd817fca1f42334df0d7b8402902548ce3313f7af85fbf1729f0b5672c5484532361c108ddceb34db98b3b10acccd5f37f", @generic="044a3921a19f610781c176df68623e898c8eb8f160672356b17314e8863ae0d28413371c6809606edd2354e8b44e0cc4159a668faf25afabee2a65a2364d2f956353962d7708a3fa202bf09ae98f0a1da6a9ca9eff2287793fb20339c00d30e170ca2ad89a7491e8de4aac64839341deac54a8054d098b4df584d29c39dad380038cd502c0dcd8c18d30c1385fb372ce92f9d4d4a422867c96f2344f88e56212", @typed={0x8, 0x82, @fd=r5}, @typed={0x8, 0x92, @ipv4=@dev={0xac, 0x14, 0x14, 0xf}}, @typed={0x8, 0x73, @pid=r6}, @typed={0x14, 0x8, @str='/dev/binder#\x00'}]}, @generic="e7bed2318910191f2389eb385ae70255a585f9423ea3852dc8c26db684bbad74cd909b435d6d83f1120da090eb", @nested={0xa0, 0x5f, [@typed={0x8, 0x8b, @ipv4=@remote}, @generic="f28df8f9d348e6c4dba55c56caa5e9f8923354e251279bdd89ec34ffa848eede15ca", @generic="f099970d8656b251847d8988e96dfcbc6f348f020f9f04384c5c2cbc125236390c344a78f4190d428cea96096b8afeb5286c28d31c0af819e64eae25b4675fe0afbc096e42ca33870b8fb3ce8f1a8b222bb430119edf7a292088422f74b5c963525e7d91918c7547ee31c24973756ad7"]}]}, 0x5c4}, 0x1, 0x0, 0x0, 0x20000002}, 0x800) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1579.038041] binder: 3182:3187 got transaction with invalid offset (7955890216726691840, min 0 max 72) or object. [ 1579.051192] binder: 3185:3190 got transaction with invalid offset (0, min 0 max 0) or object. 23:50:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4086], @ANYBLOB="f60f000000000000000000000000000039000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="3773079c16d37ed21ba962ce214a6e283c3ef27d154f4697f2653f6dce523d524189b95f01"], 0x0, 0x0, 0x0}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RREADDIR(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="2a000000290200070000000000000000010000000000000002000000000000000307002e2f66696c6530"], 0x2a) sendto$inet(r1, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x3}) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r6, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r5, 0x2405, r6) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r5, 0x2405, r4) tee(r1, r4, 0x3, 0x0) 23:50:55 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r2 = inotify_init() fstat(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r1, 0x0, r3) r4 = add_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000300)="b92e907bf6d3fbf3a7d8a61d57e0b5bb6a4490686d2b82efde3c36fd68d57dbb04eca2c0225d9f310e34f44e27a982dbd63858c4ed306c7f5a200ec67758c2a19f39606adcf659e6151095abcadde75fac394aa799df874c5ee7a1d4e9be6cb07e36547b685d0fc69bc5df056f6bca29c51d91a907ba21bb692a627d583547b55437b6135f36133dee8bb55af96de5fbaa13388891235ff8d50bad32ba1dec8603f8d003d81c33aee196a35d9ef8f8866eda74e422f53083d5237a73591e7ed3c861c2523249e95fda9982efd4754493ee9e443db08641a3bd1946cffebf060a977e2ff19489d55d4f8ec526a033186db99aebfc27c7ee70f8e3e9ffcf2c41cda4f7fe07abb885b5b5714afeea3adeea13fb9f22ffdb549f868e1bc81c4c060446bd0408f08e312dc0553063e3caad0498a3cec0cc3a72e6c6bb949bff1186a4d3b7e905722f7e612ec63076cd773e76c9b7f75f5d5c31f527f812c29289b019e9bd536acb22cabfa646e9f6796eb7afee22bb81442bcbc64b577254d3ff060d8732a082bb145bb2a76122bdec33350aa2e45e3e751af3077d0e06224b7227551e9ca03082656b46bdb0b1098884c3d57f952b24e52943cf8c6a82d85c4740e76584a5bf5292e5c91ae2a9d125aba3fc5c504b304eeeb91deedca922f40cc2a1c0abb09673ea9375ed350e60dc404bf0a1a1eabaef49b1418623aad01fb919661cde4e535c0777ab7a6726b4335737d18072861992cde339e6c7102a78135b672d436f54ec622db31d171fa73d633a38c78f317a73c8db5355d3a6100a059251d9d59f709c9968f0a5afd225c42c0e8ea98377388b14f5e679ccc4389300a5f7a55a32ee33584fd8cecd1569a348451a5d7a25c0964e12a9fbdd4351ccf62abb9b91e2dedfe45cd9fa40a69afd55dadd46dff78eb32894b5d2b5289916afd4d543024e3a34cf01091813bad00033d2d48f68443a100ab1ca2d5e859ac8f434410cd3119482f4f0df946c6ff14326710505f62dac7a744e4ff47d6002076c60f8331364aa66612ba7a9a336a290d9086cb4f83442b9d3e368819b67c87ec8c74ee871a4c2d623f893d82a8049c81840884191c270488d8b4ccff5da80d2b12a003343c4b8637b2cbdd369b7e49fbda74a05718020db2d05eacc64e61d66436ed2b7f680c50349262be21bf9464323734bebc5d2c6388b0a61d38eafa25106f9b285a88a22f010caab58c3caaf7372ebb9f3447c32c987f8d566e99532b5aa4d8bd86282164ec77cd3fe2c40261c7afac25e6a51af1852ca23948fdba6ac84faad9530e46abd3189c27c032cf51054269e8c3b62ac9766c528012ad64d59b04dbb91e2d3105cdbc958101755fe097fa32363c85556bf4dba3c3707c043f14934f838a679e9c1d526f5b1173a4d353d7702dc9151dac55a69a9b6b0c68215b82f26095529b7a72519a01932a5ef4c419e47e4149689ec1af285fd5a02dc9109ffa60ce65015032e56a62f78c6002b76ae87507e7312a61c991b9a7c8babf1615e67f6b608f40a6ea3f320dbc5c35eb2340f73a2b1700fb58aac4f8ceb18005d898f2a39182eceb03685c8fa42e2f989d77a240cc11defd44ab07368ee43c2cfd918fc63986894f73a15ed8690d395efe2141b0addf6de2a1bd1a6a53c4a2cafcbd497fddbee4981426fd267b4a0d2ba12a4310c68707eb318028f403bc0f6b64ccbf8bf299504e63e93f6169379959ecbaa36b6a2695e6f84c535546921f4333b3fb446a6353a1c27b57cdda2be99cb277ad830342c11568af9abd9b050fc0a12ba052bcc86a9c76381bd7180c7b5e78cbe8f4d8f39c159ef47fe9ecd6de48083ab1af6a8197eddf987f16d4c4502020f049d3993cb89517e4b23907bcd6d8c6ee19ab528d973d2c443bfd01e1c85f9ce135f2af8c1c7edd7248f88a3448c26011d8118658794084862d6cfd5b43041e5ca21edaa60bb5afc057aa37a159424890abde8c425981c911d192b4d8d016919df8a7c8374969ae2077ad4a3f71604c29a0b9ccfe13f0456fdeda0ec806d9ffab7996ac4147954e216fe820906a6cb6d984dbb2f5881495f71c659efae32e26f3f1075f1f31dfcbca57c8c484923e32aa30db8cdf130da4283f2767b859beff599aa06f6be87053fbc4558834e429479bcaabc9af25e9a1806fcd8cfc1a523a89ef667d763ec6eef64ab93beda7702a31ea0625eeb148bb2005f549cd7ed88a4e773704c68663919308eb1b03d8f37fa48aa162254a0b0472f625eddb00ae48f4a73eb8fee34dd7c7bf3865234d4b520d76889e1a0e7e18df0573478f0852b6de63118a251a1878d46bdd9ab66bd30e7f1b17203ad8e12002c7e40a4a58b42abda8930fb6b4132372b9aa5d63eef5fd10f9592718de2398e02e23f9702aa4a14363cbc0cde97cab1a58ad8b8edddf72f25f1b19893c4b0d9ab104164038f7e4591a40fd81f2dccf9d2dab49cb27e0cfb6ca2a9de86ea5812a92b0d5fde3906f745aeebafab1c4cace8282ec0a73467c38d9786f43f40c9751223faf956095439aac9132d19a5769ca7473798c678f1eea15e1ffddb4a2b01e57a3f0c547942add9d543cbbd5b9850e854c875910a28c8582e19a587848eee960e306f4a09b6b1d278df4334aa2ba9f20913afdaba1c9f9476407238b5975e39ec744d081b6073af25f8c2a2fad6298c8f25a25c7109d688dcda31202e9b0e7eb40a1fae69cc34852b443d8cff0c5d23bcf90d1132fa24468fb10a6f3d0676f6fcb9c15c38be73313a8d54387ab95e1d8b86832428ab67954ea144a1e6e02d88755f8de92fc2c251139b1154edc1b6534f8a56f9281989037a6834713bbfea13fd27429d1c98eb85e9261d7420cc5f8c7dcf0576e2fba003e17dcceeb07349998815af2e472f1f5cf75c9a6e9422e073942d009f2176ec8666f86cae6205e8630137e6caa8e830fe174f121bd806d07d72c3883037a4e6bb92a235fc989d1c425ecf4e118100c2725f24d82c8cc44a33ef917fb1de82735c8f12d1a1cec332a5cad9d554fd63bb95fc4da35ea6a5fb0accaa4fc40bbf7f141183e4d62dacd788e02cfc8fe515f049f82943985948cc9d2f6447aee56314df9b4e99dd3d463cbf819aaa18f6c14598321fa03e4cb9816a7c4fed95115895dcba1b2e3b1a08aab5520376094f969199aef0f3e6287426ea6121c64a1a17b473c31649a067eded3593f330e23bd4f3123375d476a473eb84b9d46632fdeda780175ab300aeafcf42cb15d2afc0f631dcbfee5c63b96118d37241028d267755100e90ef5e1e6dcef0b4f930901e670791953f18997b5cd7c2189eea64d6a454d3a8f5d6fd73eab0fc8ad1a2c2362ee994a6414e5148448644711e778378458e59f8546418f601d66d2de9e88806172d3d6fbc2b77186b6b79dd639f4d45ec0519b4fa28ee89a78b764ad9fec907b9985458dd403f6f7e942c5156be07b7ad6d1e639db0c82648dfdace9fae516597358dbedf824308e63946d3307465349556bbd8a45755d6abf36ddfca5709f68508bad47cbe281243943adbf460e712261e6e74df11218136f2daf481cf2f174f9ce0b800a348adc411aa2fa10562dc601a83c43ee4127c1a6ae73d7b309ff0711ee20e6c932eba0ccd5ac84f39fb5a288c807e038f4343e6ea8d33ff2b3150e9c868ac1fe5dc1fd4c11d7b0bf259a9a76b82fac9b15458656fd5e95a3c06fcc2293ef9c56af6c9d3762ecc8f4784bdd732cb127330fec492de0e5a214dbfb397a285b693c2f83bd6746b9b2d880afef39d9336db6b8d7c00ce6cb1c32e483576eb1c69c71501f45a25fd3ad20a356eee742bf68dd9d9dc8bc1f2fc9f6740077a20cd433bca3c8c707bcf6c4d518cd4d9f4c59f908051073a8c041fa88572c9f02b53087c02fefad2b5bf182e8f62c8759a193eb853ecd4e9cc7567d78445fc036f1697b7786b6a4ed3223f3c2fb5932c2e372e51dee08fe9849244d9b9fc2321f84ca2647d31ccfd85e7362b1142f7854dd8fd3ca7ad3664c11f5d3e588991ecc23a7071eab8b76ad14baefa4a4548045d8b7ef5c04cca0d095411abed2e2d9db99ff7ce3f55c743e929aa508c39f4a4424198adc518a6981642439e3f087befb3f1ba6ed6e960dd6651505cae743608a8b016a5f2e06609c72964ccbea771068432d24e74e6e954c2e70a9b2805ec8a4a93113fc489eba556b0cedc95416458821b6d44df211e62d032117323e08595d41921a853c03e63dea9b854d657a401166382ca0799bc72b46967bff5ca5ece09e04d316a8ca68549ff9917f8961b61caf2f67ff7c26a69151dcb25de3cf26a22d2b4487f9eb34a29a2c1ee8e954dc9b9ed16b195e7c7c83057c3b93fee927addd1f1f9b953dcbf6b64b18e3407c7ff402155bc64baf1cb9f9d14bd266aafb05a361a82926beeaa45c6cd7e2a6294e4e4158c213e6d11dbb738f6160dca8e48207ddddce0bc70322a27a4dbef7dab138750ad2cdb7f2473f3de917d9a9930086f31f54ab21ad04a6b99517b8efe5dff7154d0fb8212b5272642345625674edc887efc83a2cd4c592aac4146a225c716c844587c368e5c62d32340156153189623958e9d43a3b4fc712a545f32d678271b8aace3a08f97b3ce79d7415ed54b41954c3fed58839a8bdf662d95082b414aea73a863325fe6cb8283d2a34d6684908cc080d058d34e2c5c11bd3365e6b61237650e7e850b0f2f1995ef127b626e418e597d97029c2253cd4fff482c08debdcde54df3f8b426927f839240f1fc7d62197fdaa8a839a3bd4106749802226e1ec7f2ed93edfdbac2cc8403fc34be8ec31c13666b02ce57966efb12b01331ec8795c2e25b0dacb9f51a6152b51de703f8ec858d55da12e4e692501de9062b86f343e0a2df026a85a1961a949bc1d602ba8af04a91484d1fbf7c37ed22855304087c804d3cd96a103583d4fdce8096ca095761f11e94dc2772a417c27f1edc42cc88de046587a3811a4ec18702d369df20d831309ec407985fdc334595e8d0dbcf74679ab4d441d85d72e902559af5b58bddfbb26cec1e043d7c515f68e5b2be07abf9055ff276361f5f6d85e014eb7b8a2c590d623fc36fedd8d1eac66a1f6485a510238431bf0fd7bd340ef5138bd6e89e1a17b77f9e3a6f92189b8bd70c5d475410fed16b13a3b9da0d2c53d4f58d90f17b3a6c32a147e3648d729192818748b033c4fc52c99787ee31b5519ea5abc95886bc9cafe96b2459ccef86bde5e6441a4141f110cbdd8483a60e4354b5dce0295e62354bf114ca686398befd55bbe7cf171288fe5a29d6f8724efbec139b2486595c2df8499c3b5d27afec4c2baa515a058dcc9eb94f1a5136945c194ee5b2fd7e28b68058eeecb49f3d150030685175a92db2b0792ebfa1118a6afc37ad644e71eb3d81219b020ab430a57b620b7dd03677e9fb4980d860bc67c1bbfd49e29d3a974803a673a849b3ccb8b78c139714d83caef1d7763e67af13499bb561f9d1e4fe7b08cb4aee3deaca172054d5c05b467d4916666abdf265bce8f25c9dea08d5e056a5b940ffcb974091398b08c5f600fabf7841d0617854a0eef401c216a12dcac798741d64d7ee7ae1597c6378afa57ab450d57beba8ec0de0833b4700c3f4e9ea2bb4891f8af83f1166c3d4a3d216f1503305b4e04f6b60cc7c8c18d7fb3682145756f197d20a22612cd89b31e768b569dab23eb79cafddcdd34f2496d6e75b68df829fe26b6e1f9a889f422892a05d2b2005f98406483bfeeb03eaf341bf", 0x1000, r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000001380)={0x0, 0x0}) sched_setscheduler(r7, 0xe, &(0x7f0000001400)=0xf2) r8 = request_key(&(0x7f0000000140)='big_key\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='/dev/binder#\x00', 0xfffffffffffffffc) r9 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r10 = inotify_init() fstat(r10, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r9, 0x0, r11) r12 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000001340)={'syz', 0x1}, 0x0, 0x0, r9) keyctl$KEYCTL_MOVE(0x1e, r4, r8, r12, 0xc26e298934649e3b) r13 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1579.051223] binder: 3185:3190 transaction failed 29201/-22, size 0-24 line 3379 [ 1579.051618] binder: undelivered TRANSACTION_ERROR: 29201 [ 1579.059707] binder: 3183:3189 ioctl c0306201 200000c0 returned -14 [ 1579.063263] binder: 3183:3194 ioctl c0306201 200000c0 returned -14 [ 1579.118022] binder: 3201:3204 got transaction with invalid offset (0, min 0 max 0) or object. [ 1579.118049] binder: 3201:3204 transaction failed 29201/-22, size 0-24 line 3379 [ 1579.118245] binder: undelivered TRANSACTION_ERROR: 29201 [ 1579.172329] binder: 3182:3187 transaction failed 29201/-22, size 72-24 line 3379 [ 1579.175232] binder: 3208:3212 got transaction with invalid offset (0, min 0 max 0) or object. [ 1579.175257] binder: 3208:3212 transaction failed 29201/-22, size 0-24 line 3379 [ 1579.175609] binder: undelivered TRANSACTION_ERROR: 29201 [ 1579.215354] binder: undelivered TRANSACTION_ERROR: 29201 23:50:58 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:50:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000053925600742e4e93762f3fa1ea83db3594598fc7ffe6807475f7744f3f500ed754675a36d9b390faad73cef2a6d7662377e5efbcbcf660794de877e4f6910d7f5b57e6c7ebbc05725aa54f4485f4ab98e977e019324a3e6c0ec240d44a39215d5f5ae43262a510a9fe1a0ae8870922fedab8d7bf96a5b725c3806a7fab0ad281fd19da576a9d414f8b2c0ce2190decdaf89b8ab5f4b4ad18f24411a37fc68e7a526d2a7e6cd2539c3f0e6cada0b70b7410be09db12bb352e1b51823328aee6700cece1f85925600a9647b7db34af568e6"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:50:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00100005b2000800e5d4817220fee3185d0624ee496346dc2f132cf457daf4c680dec1ab699446b358d4eae27a64e4ae58b4f459b8808b132b97110a7161c169f429319bab3bc71e884f4415cf03ac01decf9c65287337586518c2f753a2414153beb5287de82818f13330b77b5107ca0c4bdf229352be8f3e4f0f465818d902f6c92e1a5c09255159645d0383b8097d67"], 0x0, 0x0, 0x0}) 23:50:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000640)}) 23:50:58 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:50:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000000)={@flat=@handle, @fd, @fd}, 0x0}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000640)}) 23:50:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x8180, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000140)={{r4, r5/1000+30000}, {0x77359400}}, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) write$P9_RMKDIR(r3, &(0x7f0000000100)={0x14, 0x49, 0x2, {0x80, 0x2}}, 0x14) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 1582.065880] binder: 3214:3221 not enough space to store 0 fds in buffer [ 1582.073392] binder: 3217:3220 got transaction with invalid handle, 0 23:50:58 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000000)={@flat=@handle, @fd, @fd}, 0x0}}], 0x0, 0x0, &(0x7f0000000640)}) 23:50:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000001600)='/dev/input/mice\x00', 0x0, 0x80002) write$apparmor_current(r1, &(0x7f0000001740)=ANY=[@ANYBLOB="7065726d70726f66696c652020c19bdd699940812f6465762f90eee6170de49f15720f796dd2ed572ec57986de78c37ced57a1e27684349910940babfeda30069a6b714dce4a18fb161017ba3bd9db5ffbad4f61c1679e2e3ab9c3dd4aeacb155a5a612e7848e70e3ca79a6399c97044711afb6d559cd41748d85c1b72556dcf10ea13853cddd5861060ebea635d6274278df74391017fa35565feb9c19951a4ca36755e9b42047f896943fb7524c84bbfa77ee21881e6d581ea91a3eed5d067f765096d59cf7c7ca6ceb4cdcd97a525"], 0x19) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) timer_create(0x2, &(0x7f0000000140)={0x0, 0x12, 0x4, @thr={&(0x7f0000001480)="6c10e2feae67024dc9bc97132436a0f72ff235b4ccf6b02ea11ae93a20edb30f263294dc9634b4c6650508a1eff49ae67aa0c533e1ba144ef55a4df90d8a46b2ce71ca6f36b7dd60083a89597d09b24491e52e42ccec6eae64afa8a99fe669e69d50bc5a045cead78fdd179d8228c936b96e85f9352f83e546f3ce008b76c842e1db52d12fae5b181d59b5f2032d3a47fd0a410e9f021d6de63ad3b218a4ff1a098b93679b9444cc4c9de5a595ebead6206362d7ac79726bf8e91cf26cef6650560ad2d7e7a2655dc100e2b2a567a01b6a0d289b7d3e51e62ca17fd8f2", &(0x7f00000001c0)="0e7315cf4d2d973e68210051de62d2f7d174b464a82ad52e20ffdfbe71d7fe8121ca2b8ae4ec94f32f504a3729e9d07aa9b9f5cbdeae9cb0077487fde4d886833225"}}, &(0x7f0000000240)=0x0) timer_getoverrun(r2) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001580)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000015c0)={'bcsf0\x00', 0x600}) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f00000000c0)=0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000070000000000000001867477bd80032b6b4c77f66492ae7488a77de71dc6d1671ca7f84837aa10e652ba3c382c3ae4198667a78181b5cc6883da8", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) write$binfmt_script(r5, &(0x7f0000001980)={'#! ', './file0', [{}, {0x20, 'selinuxuseruser*[md5sumsystemnodev[procvboxnet1'}, {0x20, '/dev/binder#\x00'}, {0x20, '/dev/binder#\x00'}, {0x20, '/dev/binder#\x00'}, {0x20, '+1'}, {0x20, '\x9bselfGPL)'}, {0x20, 'mime_type.selinux\xcc'}, {0x20, '/selinux/avc/hash_stats\x00'}], 0xa, "6b7fe1ab58720bc4678295e86d84b5c43bfa23e1a8c0d07f5634c7f7e93c1016f081a6b066f6bcab4d8482579d9e36f57942b3a127964b2a016f63a394d14fc119a22864a9eb0f8123aa46830ad0153e09844552bcfd392313a2da46095bcb560afa302e204bc6a460a996a8ac9fd4503f8b6517"}, 0x113) 23:50:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1582.073508] binder: 3217:3220 transaction failed 29201/-22, size 72-24 line 3411 [ 1582.073938] binder: undelivered TRANSACTION_ERROR: 29201 [ 1582.078966] binder: 3218:3219 got transaction with invalid offset (7955890216726691840, min 0 max 72) or object. [ 1582.079112] binder: 3218:3219 transaction failed 29201/-22, size 72-24 line 3379 [ 1582.079536] binder: undelivered TRANSACTION_ERROR: 29201 [ 1582.114607] binder: release 3229:3232 transaction 1679 out, still active [ 1582.114612] binder: undelivered TRANSACTION_COMPLETE [ 1582.125430] binder: send failed reply for transaction 1679, target dead [ 1582.135716] binder: 3231:3235 got transaction with invalid offset (7955890216726691840, min 0 max 72) or object. [ 1582.135744] binder: 3231:3235 transaction failed 29201/-22, size 72-24 line 3379 [ 1582.135956] binder: undelivered TRANSACTION_ERROR: 29201 [ 1582.167054] binder: release 3238:3242 transaction 1683 out, still active [ 1582.167059] binder: undelivered TRANSACTION_COMPLETE [ 1582.173396] binder: send failed reply for transaction 1683, target dead [ 1582.185320] binder: 3241:3243 got transaction with invalid offset (594699544, min 24 max 72) or object. [ 1582.185360] binder: 3241:3243 transaction failed 29201/-22, size 72-24 line 3379 [ 1582.185817] binder: undelivered TRANSACTION_ERROR: 29201 [ 1582.285291] binder: 3214:3221 transaction failed 29201/-22, size 112-24 line 3475 [ 1582.295151] binder: undelivered TRANSACTION_ERROR: 29201 [ 1582.301724] binder: 3214:3247 not enough space to store 0 fds in buffer [ 1582.308719] binder: 3214:3247 transaction failed 29201/-22, size 112-24 line 3475 [ 1582.318037] binder: undelivered TRANSACTION_ERROR: 29201 23:51:01 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000001480)=[&(0x7f0000000040)='/dev/binder#\x00', &(0x7f00000001c0)='/dev/binder#\x00', &(0x7f0000000200)='lobdevloprocppp0[\x00', &(0x7f0000000240)='\x00', &(0x7f0000001340)='#,posix_acl_access/\x00', &(0x7f0000001380)='/dev/binder#\x00', &(0x7f00000013c0)='/dev/binder#\x00', &(0x7f0000001400)='\x00', &(0x7f0000001440)='/dev/binder#\x00'], &(0x7f0000001600)=[&(0x7f0000001500)='-wlan1\x00', &(0x7f0000001540)='\'\x00', &(0x7f0000001580)='&\x00', &(0x7f00000015c0)='*\x00']) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="fe0c502ed6c050e9a8f645fc08c64a0d605cf80100000014d80a80374f47b5edea3878cbfa70b045f6161f5dcff9f329b70dca6de0129c5a29b4aeeca204c8e72d44c8783f0a10cd0e6a2df8035f80e20dc7cbf5"], 0x0, 0x0, 0x0}) 23:51:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000000)={@flat=@handle, @fd, @fd}, 0x0}}], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x44000) io_setup(0x3, &(0x7f0000000200)=0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_cancel(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x7, r1, &(0x7f00000001c0)="0fa7a9a4b4397ce0302c29fa9ce0653ba85e2e37f333042107744cbf5268da9e9a3fd4b16d3cfb47558dd645befb9df3b510438c0acc1f91498ea6b6654eab2d9e388755ffeac13f612b25d97fcb90665d343ca6240eb7e9aab9551a13eb3cab005c87864aea062f80e8f50541c584e8af24ad3d927008201c4810b48ffad4eeff6155b8975eceea", 0x88, 0x7, 0x0, 0x0, r5}, &(0x7f0000000140)) r6 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x200, 0x0) ioctl$TCFLSH(r6, 0x540b, 0xffffffffffffffff) 23:51:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:51:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000002134b0000000000000000000000000000000650000000000000018000000000000009d4a48783fdd7efdb73bc11833e41bcd93d4c39d752d98c31530a8caab4b0dc762c90ab1e5b957a1ce9d8fd136d8", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:51:01 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 23:51:01 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 1585.100367] binder: 3249:3251 not enough space to store 0 fds in buffer [ 1585.111804] binder: release 3252:3256 transaction 1693 out, still active 23:51:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000180000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c795) open(&(0x7f0000000e00)='./file1\x00', 0x0, 0x0) mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='mountstats\x00') sendfile(r2, r3, 0x0, 0x80000008000000b) 23:51:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000100)) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) [ 1585.111809] binder: undelivered TRANSACTION_COMPLETE [ 1585.116423] binder: 3248:3258 got transaction with invalid offset (594699544, min 24 max 72) or object. 23:51:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000180000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32, @ANYRES64], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000180000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_SET_SWBIT(r3, 0x4004556d, 0x8) [ 1585.116463] binder: 3248:3258 transaction failed 29201/-22, size 72-24 line 3379 [ 1585.116667] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.138052] binder: 3264:3265 got transaction with invalid offset (594699544, min 24 max 72) or object. [ 1585.138055] binder: send failed reply for transaction 1693, target dead [ 1585.138088] binder: 3264:3265 transaction failed 29201/-22, size 72-24 line 3379 [ 1585.138507] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.168864] binder: 3269:3270 got transaction with invalid handle, 0 [ 1585.168894] binder: 3269:3270 transaction failed 29201/-22, size 72-24 line 3411 [ 1585.169260] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.231907] binder: 3275:3279 got transaction with invalid offset (587202584, min 24 max 72) or object. [ 1585.231948] binder: 3275:3279 transaction failed 29201/-22, size 72-24 line 3379 [ 1585.232167] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.251545] binder: 3285:3287 got transaction with invalid offset (587202584, min 24 max 72) or object. [ 1585.251581] binder: 3285:3287 transaction failed 29201/-22, size 72-24 line 3379 [ 1585.251990] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.278235] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=25955 sclass=netlink_route_socket pig=3284 comm=syz-executor.4 [ 1585.278774] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=25955 sclass=netlink_route_socket pig=3284 comm=syz-executor.4 [ 1585.278815] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=12380 sclass=netlink_route_socket pig=3284 comm=syz-executor.4 [ 1585.308825] binder: 3288:3291 got transaction with invalid offset (587202584, min 24 max 72) or object. [ 1585.308861] binder: 3288:3291 transaction failed 29201/-22, size 72-24 line 3379 [ 1585.309264] binder: undelivered TRANSACTION_ERROR: 29201 [ 1585.439942] binder: 3249:3251 transaction failed 29201/-22, size 112-24 line 3475 [ 1585.449964] binder: undelivered TRANSACTION_ERROR: 29201 23:51:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="0000000000000003280400ff0000000050fbffffff000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) ioctl$PERF_EVENT_IOC_DISABLE(r5, 0x2401, 0x81) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) sendfile(r0, r3, &(0x7f00000000c0)=0x400, 0x40) [ 1585.545574] binder_alloc: 3295: binder_alloc_buf, no vma [ 1585.551450] binder: 3295:3296 transaction failed 29189/-3, size 112-24 line 3284 [ 1585.562064] binder: undelivered TRANSACTION_ERROR: 29189 [ 1585.568648] binder_alloc: 3295: binder_alloc_buf, no vma [ 1585.574452] binder: 3295:3297 transaction failed 29189/-3, size 112-24 line 3284 [ 1585.583615] binder: undelivered TRANSACTION_ERROR: 29189 23:51:04 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r1, 0x3b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 23:51:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB="000040000000008028000000fdffffff4f2884f1a2e36411"], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) 23:51:04 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000700)=[@acquire], 0xc8, 0x0, 0x0}) 23:51:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:04 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:04 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000300)="1f6d940d7f5e86400ccc8faa0ba6fa16a4dda321da840e80f5da327820322a3d163b5f2d5c3e14b6e0549c8e1fd479ca5423a64ddddcdf85858b40d8ef89249fa740f1837f6ff0c53728825c493935c07447cfe27acff016248e17a4def0dc2373618fa1dac74cbc77920f2e8d29a23ae6461fa87c3589dd0d836c06f950738be28d18f4baf11f78115b5a0ff27fedca829ef9d7ab2f2be71935bd9df6dbbfd6de5b8f73cac0a97547a17b5415f1ffdbb9f880d75f9648bb4a2b9b58a0372ae38c0ac77419c52757d9ad408751b0fb2dfdcaf5659150e8fff77b418da8e070e2b6d4c0252a21a33027043c3fe06734381e4d84ac468a74dd1c9b7fc366252024") r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$UI_SET_RELBIT(r4, 0x40045566, 0x5) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f00000001c0)={0x10, 0x8, {0x51, 0x8, 0xfff, {0x9, 0x9}, {0x4, 0x4}, @ramp={0x4, 0x1, {0x1f, 0x9e9, 0x7, 0x4}}}, {0x55, 0x3f05, 0x80, {0x3f, 0x9}, {0x400, 0x2}, @ramp={0x101, 0x3, {0x4, 0x800, 0x1, 0x1f}}}}) 23:51:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x51, 0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC, @ANYPTR=&(0x7f0000000140)=ANY=[], @ANYBLOB="c6d6ca5652e6b3409de142385aa1a73b884c8b9d8e7d92d7ab96de1cbaa9bf34163e7e47b0c8e61b9f4540574558b621a70fff36b27ecb8c77ac7b87d32b947001a343de0b"], 0x0, 0x0, 0x0}) 23:51:04 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000200)={@random="ff772b82ffb1", @random="137f873bd232", [], {@ipv6={0x86dd, {0x0, 0x6, "ee0600", 0x30, 0x40000000003a, 0x0, @local, @mcast2, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "eed5a9", 0x0, 0xe6, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}}}}}}, 0x0) 23:51:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000028000000f03f00005000df0000007e6a138dbf8b3b3d417a9461d12fc4ac4f8809c80200addcaec7c95325e5aadc1cdce19197251ed9ba2e7d6b014faed0312e74d967909a0bc3517e189e7b81a9dd7647bcbcf9525212c2c89a0330d2f6968d09584155d6015b10b76929fc373e6dd1f69b1e746ea2c86fa89bd22ff1a06ab70aeadf8dcf51c6ebe08c4dde727807c118a3023ebd389f572c232a3842785b8a183f657ef9a53b7f70af7e9591dc0816698ddd4f267ba1767149dca3f134a4052fb07b013f21120aefa8ad28079e82c8f52d"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f00000000c0)=""/52) [ 1588.121089] binder: 3300:3304 got transaction with invalid offsets ptr [ 1588.124034] binder: 3301:3306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1588.124047] binder: 3301:3306 ioctl c0306201 20000080 returned -14 [ 1588.147193] binder: 3300:3304 transaction failed 29201/-14, size 72-24 line 3330 [ 1588.156503] binder: undelivered TRANSACTION_ERROR: 29201 23:51:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getcwd(&(0x7f00000000c0)=""/132, 0x84) 23:51:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_pts(0xffffffffffffffff, 0x400000) ioctl$VT_DISALLOCATE(r2, 0x5608) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001600"/4091], @ANYBLOB="fb0f000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000"], 0x0, 0x0, 0x0}) [ 1588.210492] binder: 3313:3317 got transaction with invalid offsets ptr [ 1588.223800] binder: 3313:3317 transaction failed 29201/-14, size 72-24 line 3330 [ 1588.232441] binder: 3322:3327 got transaction with invalid offset (70300024700968, min 40 max 112) or object. [ 1588.232467] binder: 3322:3327 transaction failed 29201/-22, size 112-24 line 3379 [ 1588.233241] binder: undelivered TRANSACTION_ERROR: 29201 [ 1588.268080] binder: undelivered TRANSACTION_ERROR: 29201 23:51:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffede, 0xfffffffffffffc31, &(0x7f0000000280)={@flat=@handle={0x73682a85, 0x110a, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 23:51:07 executing program 4: socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6(0xa, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f00000000c0)=0xfffffe0e) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="185c7ffe74bf381bc3f60b81eedb64add42ae2fc7bffbcb311a7392fb7641b31daeedc334acd9c6d7d9db1ecd45f0876c3e7a75c13958ea37311460597acc31ad9", @ANYPTR], 0x2) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x8200) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="dfcc7567b0cae0bfe672c567204efd185786e7262217f6cee2791499d989e07017e5b1cf22d9942e7eb582ecf88e9bf368c5bfe5bde2735e8ea55d73359c6d9190b0457c7ae393fb7dbe857fb67b11a7372a48e327a6d056b23040bec4178906b527fb8e91af69a464312c58f2ac40fa20b120359613dfa88de4ae677f8427ae87233d52c205b386025cb2086d430e48ca08806232a571b0737bc9ec9d6958f9", @ANYPTR], 0x2) r2 = open(0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_SET(r2, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x40000001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x1, 0x0, @empty}, 0x1c) sendto(0xffffffffffffffff, &(0x7f0000000000)="120000001600e70d017b00d473fc0000", 0x10, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001ac0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) mkdir(0x0, 0x28) 23:51:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x101000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:51:07 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_origin(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x2) 23:51:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) r6 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r7, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, r7) r8 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r9, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r8, 0x2405, r9) r10 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r11 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r11, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r10, 0x2405, r11) r12 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r13 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r13, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r12, 0x2405, r13) r14 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r15 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r15, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r14, 0x2405, r15) r16 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r17 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r17, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r16, 0x2405, r17) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="04000000000000000000000000edffffff000000000200000000000070000001000100001800"/52, @ANYRES64=r2, @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYRESOCT=r4, @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYRES64=0x0, @ANYPTR64, @ANYRES16, @ANYPTR64, @ANYRES64=0x0, @ANYRESHEX=r7], @ANYPTR, @ANYBLOB="45dfa16ffd356ef5aab0efbd83a2bd0bac353b9e7308ee9357137290ae3c16adf768b54bf62c2505243e9ab443ef2d3d7c1d5bc6999e9201f901db0d80c37a5e49be769f51b03a1b29e3a8f654a153a4b7a3bf0f64f53f7498ea52ac29e85553759064f4c486f61c8641762907cf38cbbac8cc1f1382f0d6cf6782e72d18cbc62aa1bedfdb04cfd665d608506c21ddf32681e73888f05d4b41cf2a1232d9d83c1a17f63ed1f28c8000d61218cccc8dcfe4a650f112e351d623947f10549570a9128f749a7e84ba2f935f8900451b7448c69ae2a659971400b798c5736c", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="6219d585d059eaf0c652af59d08fbdf35f", @ANYRESOCT=r9], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRES64=r17, @ANYRES64], @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="5903ca091ad767b0a05b34cc82049e6c29aa7df410eb45344c818399574faf23f3f1b2a6818ec5345b6c6a12a3e2382ea2f392edefad7ad0cdca07465865658c2e20a514f021e0cc", @ANYPTR64, @ANYRESHEX=r11, @ANYPTR64, @ANYRES16=r1, @ANYRESOCT=r13], @ANYRES16=r14, @ANYRESHEX]], 0x0, 0x0, 0x0}) [ 1591.129482] binder: 3333:3336 not enough space to store 0 fds in buffer [ 1591.138588] binder: 3333:3336 transaction failed 29201/-22, size 112-24 line 3475 [ 1591.147620] binder: undelivered TRANSACTION_ERROR: 29201 23:51:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x70, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x25, r6}, @IFLA_LINKINFO={0x48, 0x12, @ip6ip6={{0xc, 0x1, 'ip6tnl\x00'}, {0x38}}}]}, 0x70}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@mcast1, 0xd, r6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) [ 1591.209644] binder: 3347:3353 got transaction with invalid offsets ptr [ 1591.227520] binder: 3347:3353 transaction failed 29201/-14, size 72-24 line 3330 [ 1591.231037] binder: 3346:3352 unknown command 4 23:51:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1591.231045] binder: 3346:3352 ioctl c0306201 20000180 returned -22 [ 1591.252271] binder: 3346:3358 unknown command 4 [ 1591.252280] binder: 3346:3358 ioctl c0306201 20000180 returned -22 [ 1591.287089] binder: undelivered TRANSACTION_ERROR: 29201 [ 1591.296232] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.0'. 23:51:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r2, 0x40505412, &(0x7f00000000c0)={0x2, 0x3f, 0x80000000, 0x0, 0x2}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/4091, 0xffb}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 23:51:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1591.311368] binder: 3361:3362 got transaction with invalid data ptr [ 1591.318211] binder: 3361:3362 transaction failed 29201/-14, size 72-24 line 3316 [ 1591.329701] binder: undelivered TRANSACTION_ERROR: 29201 [ 1591.370512] binder: 3371:3372 got transaction with invalid data ptr [ 1591.383397] binder: 3371:3372 transaction failed 29201/-14, size 72-24 line 3316 [ 1591.392420] binder: undelivered TRANSACTION_ERROR: 29201 23:51:10 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:10 executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4000, 0xd0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffff0700000001000000000000004500000000000000090000000000000000a00d0000000000000000000000000000000000000000000000000000000000060000000500000001000000000000001f00000000000000010000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500bbad7853510b35c"]) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) 23:51:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR, @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:10 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') [ 1594.140515] binder: 3376:3378 got transaction with invalid data ptr [ 1594.147222] binder: 3376:3378 transaction failed 29201/-14, size 72-24 line 3316 [ 1594.155848] binder: undelivered TRANSACTION_ERROR: 29201 23:51:10 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd80"], 0xb}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0xc0a, r0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000040)=0x1e) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000000)={0x8000, 0x5, 0x7ff, 0x20, 0x17, 0x0, 0xe1, 0x88, 0x3, 0x3fff8000, 0x4, 0xe53}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r3, 0x28, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={r4, 0x4, 0x18}, 0xc) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r4, 0x1}, 0xc) pwrite64(r5, &(0x7f0000000100)="54049420abdae6a1d05801bde412cea4491994af18ef24982a3129f05cd8d7e98f698a607e8c4a6077016da9385611fd8f29cfcde54c4e0d880e8298e9e7e8a00119ab6103d9385dfa340efb46cb6882c38295dd56d5777e9f4dababbd963e0a9dd22f01810c7096", 0x68, 0x80) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 23:51:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6", @ANYRES32], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:10 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x44000) io_setup(0x3, &(0x7f0000000200)=0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_cancel(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x7, r1, &(0x7f00000001c0)="0fa7a9a4b4397ce0302c29fa9ce0653ba85e2e37f333042107744cbf5268da9e9a3fd4b16d3cfb47558dd645befb9df3b510438c0acc1f91498ea6b6654eab2d9e388755ffeac13f612b25d97fcb90665d343ca6240eb7e9aab9551a13eb3cab005c87864aea062f80e8f50541c584e8af24ad3d927008201c4810b48ffad4eeff6155b8975eceea", 0x88, 0x7, 0x0, 0x0, r5}, &(0x7f0000000140)) r6 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x200, 0x0) ioctl$TCFLSH(r6, 0x540b, 0xffffffffffffffff) 23:51:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x1, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1594.240770] binder: 3388:3391 got transaction with fd, -1, but target does not allow fds [ 1594.242557] binder: 3393:3395 not enough space to store 0 fds in buffer [ 1594.242581] binder: 3393:3395 transaction failed 29201/-22, size 112-24 line 3475 23:51:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x3c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1594.287798] binder: 3388:3391 transaction failed 29201/-1, size 72-24 line 3427 [ 1594.294181] binder: 3403:3405 not enough space to store 1 fds in buffer [ 1594.294205] binder: 3403:3405 transaction failed 29201/-22, size 112-24 line 3475 [ 1594.294335] binder: undelivered TRANSACTION_ERROR: 29201 [ 1594.295464] binder: 3403:3406 not enough space to store 1 fds in buffer [ 1594.295488] binder: 3403:3406 transaction failed 29201/-22, size 112-24 line 3475 [ 1594.295706] binder: undelivered TRANSACTION_ERROR: 29201 [ 1594.333766] binder: undelivered TRANSACTION_ERROR: 29201 [ 1594.357073] binder: undelivered TRANSACTION_ERROR: 29201 23:51:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x1, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:51:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="a02a7470000000000000000000000000000000000000000000000000000000000000000000000000852a747000000000000000000000000000000000000000000000000000000000000000000000000085616466000000000000000000000001010000000000000003000000000000004c0e1f98d5341de0481cafd608be0ac52c2896297875c7aa7fe0ff1de1df1b78e91bf6d6562f486c2b43882d5b7e322fd3775d50b2a8f95735be7499552b744c1228d8bd72491b41aee6da46a61cb2669781fb3a06bbf0d0f0a161d3eef669bf901d7d5bdfc17992dfcbf54ba571fa63f276197f4d4e0b920fb1097428113f6d820e65e0dadfb6cdb7c415286abdc56ec9b653edaeb663b0"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self\x00', 0x20000, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = add_key(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000340)='\n', 0x1, 0xfffffffffffffffe) r6 = inotify_init() fstat(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r5, 0x0, r7) fchown(r2, r4, r7) 23:51:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="0000ebffffff000000000000e8bc646600002000854118237dd9ebbbd3d310e26f69d8438d4227c22a9db0adb02c3d6fcf30108c4944e228fbb57e23b5e7d7bc0ae636023ca7b76d053f266c1f49f4b8eec7f71f90dd1370bd256677f07958fd85b9b914569d22fa1c1a3fcbeb9b5b5d87edf692e8926946d42052f77612e06f951c0eff00000000000000c878e68e44e18ad35f6b9a35c44630970b568bfde5c0de1f7764afa36bcdf690e9dc30a6e754a77664cf99705ed91da08b4b2a0b46488c261d0d541481fbd84c151bde3a999db503ae5c3961bf0000000000000000000000004d8b7eba72c86901eb7418b55d19a197524890ce7fa9af9caed6030ae57ac82d06f980b7ec2df20f4bbffd636b085864494c4be84a1bc7465c253caddf816327bf0ea60691f39a8f7bba61f35e9f72e6817e7a5a93a4bde1415f442ffe13564c04d75dd682b02cbd09ff6503827c52d86d592190142288946425382ac5d340ac1a833e6eb0f6f14fcea94a445f9bbe56a0d9bb99100cc6"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) 23:51:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x40, 0x3, 0x4, 0xc4, 0x0, 0xfffffffffffffffc, 0xa410, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x40, 0x4, @perf_bp={&(0x7f0000000000), 0x7}, 0xa, 0x8, 0x5, 0x7, 0x100000000, 0x2, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280467a7462010000000000000029a741efca37d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b111f2db1de02cad00e9ff492b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0bcc102cc66b58df3a0dba552208af3e7396aa7dc73cc328c38e1bb0c4433ecf56824a1e508cc38039864de6a01526d2f68ac81fdbaf7328ebd6c3a95c86dda8ec022ddd0bbc4362de85463b84d78a74f35a05134d7f1fa421ef2b537e3d17", @ANYRESHEX], 0x0, 0x134}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:13 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = dup(r0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x2c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="d1d2b93c38f19c0400cd80"], 0xb}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="eac33b303b222957eecbc624877cd573db3b91e7f1ffd7d7b4d45e5fc53d62d7e4ab56ad8e39808e00009f3300000008f22ac5eddbb590f86e000989cba8f7df7e974b6ecf743c071ca460d20ebe5a02191a000000e7ff1f00", @ANYRESOCT, @ANYRESOCT, @ANYRES32, @ANYRES64=r2, @ANYBLOB="e6c5ebf5c5932eec510100019b3d7280437a7462010000000000000029a741efca44f937d0492482ba834057548c402cc43b3897ccb5430331f633e7ec2bc40d42cc3aa39f2441d8ece5ff1b9d9e2afb674462b435729c12b0f1c4872b0001000000000000f515586de3c101e4f8d1b12b1894ef983d0cfcdfbb1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef000000000000000", @ANYRESHEX], 0x0, 0x154}, 0x20) tkill(r2, 0x3b) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 23:51:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000053925600742e4e93762f3fa1ea83db3594598fc7ffe6807475f7744f3f500ed754675a36d9b390faad73cef2a6d7662377e5efbcbcf660794de877e4f6910d7f5b57e6c7ebbc05725aa54f4485f4ab98e977e019324a3e6c0ec240d44a39215d5f5ae43262a510a9fe1a0ae8870922fedab8d7bf96a5b725c3806a7fab0ad281fd19da576a9d414f8b2c0ce2190decdaf89b8ab5f4b4ad18f24411a37fc68e7a526d2a7e6cd2539c3f0e6cada0b70b7410be09db12bb352e1b51823328aee6700cece1f85925600a9647b7db34af568e6"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 23:51:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x1, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:51:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 23:51:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a646600000000", @ANYRES32], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000018000000"]], 0x0, 0x0, &(0x7f0000000640)}) [ 1597.168581] binder: 3411:3415 got transaction with fd, -1, but target does not allow fds [ 1597.168858] binder: 3412:3413 got transaction with invalid offset (0, min 0 max 112) or object. [ 1597.168884] binder: 3412:3413 transaction failed 29201/-22, size 112-24 line 3379 [ 1597.170100] binder: undelivered TRANSACTION_ERROR: 29201 [ 1597.199982] binder: 3411:3415 transaction failed 29201/-1, size 72-24 line 3427 [ 1597.209049] binder: undelivered TRANSACTION_ERROR: 29201 23:51:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000070000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000008561646600000000000000000000000001000000000000000300000000000000"], @ANYPTR=&(0x7f0000001300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2f42f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x1, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000940)={0xec, 0x0, &(0x7f00000007c0)=[@release={0x40046306, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat=@handle={0x73682a85, 0x11f, 0x2}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/160, 0xa0, 0x1, 0x30}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x78, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/143, 0x8f, 0x1, 0x31}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/143, 0x8f, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/63, 0x3f, 0x2, 0x27}}, &(0x7f0000000540)={0x0, 0x28, 0x50}}, 0x1000}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x6634b698f5c2d852, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x1, &(0x7f0000000580)=""/186, 0xba, 0x0, 0x38}, @flat=@binder={0x73622a85, 0x110b, 0x3}, @fda={0x66646185, 0x5, 0x2, 0x11}}, &(0x7f00000006c0)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x1}], 0x7, 0x0, &(0x7f0000000900)="71c8d30a5d1d89"}) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000980)='/proc/self/net/pfkey\x00', 0x10000, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x23, &(0x7f0000001340)="f2f1a701bd477d42633b44025cbc11d6fb51f75e42e1e8b2f01d0fc6c08fd34146623739b769a50349beae429b40683e561acc1febf07a80107a317b6ea5ca6b3f1f9aaea95787b5dbd81ad6c191524869397ed3d88949ba2c407437ace7a0a398da14ca93644491e84fe846cd891d7d5f88d6e6d9e03851bdfdf2b21d482427009067425f48fd29b86b0107e1d2398116e956b379fb77a37ebe32d85a4715f1cfaa9f91eb4c009d5bc0e69930df55a83533691672316e2d3239ae9303b75d4531ee9f3f17c99c3daf7ade4f7de9a217c2d055c0e8740a430e0e6bc090a9d8e4bb0b89fe40b0abcab8351e80834c880cd6c959f22448156d2c8c96df5b3067feb6891c1a6db8275665537add4aaab65677c9b60be52db09fe241bd14751afc1e9021a96682fff296d79b28026e1f6f545d33c23049be58f6f9486a0ecd2a6b5f91a05e8988a8b81f0718cb2a7bab96e0357d792d84064c172761dad095df16838f9a50b7cb069ba0a91adb1108eb4bd3003aa6938055d0c8ceddd37d429c0bab642cf018fdb48005fa4565b9f200a0c0c0ab4123d7b9de95fbfe3f9bc209110eb1fcc586baaf77bfaa67c82750fd6f0f2bdd799e900dabcaf27b296ff48cad5e0550a9fbaa2694acc8da074d315f1f0bc653ea1d8c7828f6f0134f328e5920dbba36145be78eb97920bad03af14ecd05e3d1f4ab179e624dc9c35fac81811f85fc2c3b7c5ad0916f2ff3a38a07ff35c4901c85fcbcdd246990f31c24b3a20393d4e0485c5c49f132b3d9ccc6601ed6e1e2b65f1a10c219f624558d53c1769138286890dfbab78f85e01440749e1c53fe91a3bdf9503037b353ae185a03e8bc89d2dd7e37750249af526c63368ca7b512d587f99299b4b88cbeb8e19ba1dc2c913638745dfd25581a867d1f6ebeaadb61c5304cdb09783590802bc0d35ebc6cdfe05a5aea7a5f6eba6d15d5012d14527b4830d09e0f046aa3001f9f740ef0a007ea40a70d02d59e931adac2f6f8120a0de6dc3783dbe37752aaba8c25955687209c2e96496689a1e161f21b3005c8da36c410ea8e565f32373753922b8107409caf8263e0f8173bbd0daf5d8f8bd72a55b86543adadc9fdc3a9de87a741654567b32f5b9cc5591bd4e46f439a0e55b9c5642aa130d1678dff401e995d70380291ed6bb49fcbbc8cd22b43d611a04a826802825ab527cf25bc1277f39ba4061b0987aebe2bb177879c07cd8c6205b93f345388e8646426a12cf11080d95088c646337fed7b918b4b8f28e7ba4fbb11308ac5f868be1c551b5262f18bed982a096d0124bad484c1973ca94b553c7ef59da25c5a88dff1c677961b47e56be04398e11698e89ba4aba413bddb30a7605ac4a14290d32762d39d6d71ed58059303bd6f39d7f434385ce971970f747f26351747ccdd516d03451f9cdfa18ddd3a16d78c328a97a43ecd1edc9e007ae228f1166b7a2920f4eda4e22d39361e521c393530a66261edd34275c59eb02bb80761700cba9d4de715ee4f0be733a1d2f42e3174fb798588bf8ae0adb910598bab3e3de663e217cb3d2d0956968aef5893c0cf7f953dfeb585b93f54b0b602fb9ad9cbab250daa7a09d6e1179023f24005084d14159be545ad56585505bed6e1f7276aa8fc9299fe3eab8170e5b53a7cc54d4959f255d82276acdafc66a3652a0aec289b11bf1d0b05bb74eaebc1a659243b7f6f7fdb91fee13b76c9037f7d721296556d68102b81505d3762cc9f76d2848debfad9b7eed14dbbed24ea905b17af6f6583a086b3fdac6ded699d58e2d23b9215f7a127c8cccd72ff8cb2b4a2baf28c9220bc0228a7a9a8701efb3d7488d3c9f801ac213623c98c37fc08fb2d176427461c0cdde53dd14b941f802ad5c00e8e810d3a50e6b371b7cfb0fd0264a69acf64f684e507dce8f1c117004c3cdb92ebdaed68c6c20fe279eb1706f41a7b2fbd1588e5d8ebac7f827de832375d4361e0407edb80aa70d324aac586d3be0096bfcdb23fb6cbb7ad3a5698749f1b4719fab85714b03265bacb7dadb3bcc6dbc748b54cdb4d0bfff29b68ed745a3e093025f5b049cfeacf838c587bb87724ab13646fd2f86840f624836868da8358cefad8dc89ed568cbc0c9bed5f4986ee32e3b517b0f242750a26680d5015757ef441b9dd66a75a5a37bf43aa96b5f29460c8d93472512a06ba9344091ad3981f83fe8a6ea9b9a59ecd534dbc2efa2ce5d5e2976a3b91804999f667f9a8e96000c01a229680f301111d99babd2c2ff4a9fbf626d54eea8cbeeaf89054af528be09fbd725c96801c8a45a907ce5f177a2e65cca957551689bbb0b3c4a6254e254637b565eebceb46c6bfeef5481b995ef065a4d2ecfb1b2968bf5f233091f927a6b32ec733c92bc43f8b418de810a9ce2ac68557e01b392b7c6f93c4211438a314599b96c84a89da0390b931f018a37656d9e3fbd11bbdf44af4a564a4e89faab82ab46178856eddadee4d7cd86d26b16550f56481d81c8754ca678d0cd2158402b47f2d0e0a06cb65ebb6016574f37b9f88e06a55ef26c56660f3332e95585c4cb99b4848b44ee328e7f5090e0c9a510a321954f8d7b9e426ee2a8ab088cd71ff6962ce9143f27f519654e48ce3394577b02f80a63606a7ffbe8b87245a8411c7e58e0c1d7775b3598b5cf81c0664f546d22c50921999a9c333ee1a26c99d8c03012ec5aa03774cac853cebc1af207b3cab5efc81fb99d084970a8315c8466e1efff326df274b01dcd9762ed32e945dce408293bdb8af33a1277c02a5e85ce5a9bcb2604449e2fb3b5fe97fdb2708521f4417b11fad2374868213361a235001bab7b92479ad9c67651e184f292abb5eab4ee98113b73b39955a29a3144c0d41f87e4aaebb96894eec0f95e53abf8fdc60c9fd3579e95811ca57871feed9ce3285d0aed61a9ebe1194e9ed4bafe60d7d075f1d0b1a401c8eda4c6a5d72e890f220040bf6dde52d45a1328a17eaf90fbca3e31e7a7f8486688a77ff6134a259b839b9690de64e9161debe02351dda4d187290bec37e6fa17c6decd06512f09e8478445d9af94bbe37771681ab4920f68261e69898013c83c0e5a3ec3594ab0f213b57cef47c75fcaaee1d52c7af44bcf06a1525c974cab309ebd56acade26ba75fc8bb3df293ed439784a2f4a62bd638a4a766609b55ad29dacef2490a4294c4e8ad4aa066d0af4e93375775b51b38140665f89a62094d60526c44149e123526211da151c4b3f7c7bc5d6e811b3be1b37077dd62bcaf5c206be80d3b6f97363a436fc60c58002c35ba2848978389250240b69cb7ff2d8930905394d91334f91c5a7bbc09590881eca7c27c843cb9899f54215698dcff96c820f09c096eaff7e127123102d84864feb54417965d6281df9401a24befc0d13f7c2d1f230ca763699d10dd80777cd53c96362f6df71ad42a8b692985671b32fe426a1a131341791f5ecc3b52adcf4bcd55739877819cef087d16bd7752b831cfc697aa57622335584d6f8214340ea7d0c9548cd86d0421b004829db45f8c3e8986d676555140049678c793c100d2ca77e23e8dbe53fc5a489fae8d02b0106db78813ef98c239722a0405a8568cd6b96b3de9df31578768020a3946dd2d4fa721da342d98dfa10a4c4f4bade1b74acf0fd65a7ffafde01c582e84dad8073a3774addb5baa49b88930adbc58d452c8e3ff8271e8977bcefad3d13903dd44dccc2b325a6cbdd90d8d992748dc3252358475991a5eefb5679dcdedb6f588916dd981a43db61673fa45ba2c9eff03e5dbb1ea8e0af1da217d8f33ef9ef19f347935b2d16cec068c8019f62adc288763c9ff8d016b1b98c2b43d435d80b3d35ae625c464c579bbc1a72862a413b79bec3bce5fbbb6bafc3516f4cc81495bba0b2e266eaf966ade0776fc79444a6c3d590b6fb5fafee12af750b82ab4d25113d4c91ed8d210f1e6f904fe6e0e0c9dd4da1feb1ca96d306a8d0e0878cb56524fa32807482884867d13b32ec7dac56739711a933ea68d28c3b4a5d9bef3b5ac39376464a9ced8937a4d82a504f5792531b8b678dabbf55100b571dc9fa6a656badda029466bd69686b9a0e51bf1729ad8813ca4887890db77f9cab10e10f4ab88d1ae55e06da655be86eba1d12db3c34d98cda383a9ecd5399fa8fc9660b956ee216f1c424e22e4150f2a99d9afaba84aa7b655ed855de118b0062f6e278174f576fa92108d9d748a38ca9554558e938c2bcfd4eb088c6bd71e5386bc74465fa75cbd6b4a8cdae9b7a3987091ed5ec9c336d05acca4cf0451f8db9187d27ddfc3588bf9a2101501f46c607016f6f034fee31086645c6a988373d81d6b84cb73e08d1befa1b443b4a28dc26645e84d7a865e5af8d0aca56cf3814563234a6889b6b5af941a052ce28a13b94c42768776bd1c01dc46d85c86e76697db34b3827be542266df0eeab8e134a379bd0a54f0cd381971b67204b07ee0e11b2ff45484fc818285e8ebca639bb28f406f049bee652c3a0be3c4adda1439ea343d065f88bda87c042416f05871ef228d9aa52c99da9b7156eaec426ba6fd40a0e6b12b378ed2763e19837f20bca163daf46a703b3c72b0b702b3adc8d29f1d688831b4b1734fa05418918ce92efc1640da35b634a45830ea7e9558ea50b3522dc5020defdfe3c7c833c2980c590d202d1cc63faf5338d48090b1d3badd4a8a9b3dda7aad38fd518d4fb39d6265a3a9c3ab18f4c57601c5b7b9b586f4fe9b9829ee78f340775b474c9a8770783747a8dbeb77da6a5d2b225558f08e647e9dadbe40124c7ab4b862aeaae67da338ffc5505e941415756052d43175e1f061b2142b06737078eb00b98ef33ebb6b82ba13cd99db4ac71b0d2ab67050be569ee60f2a2fab5f5f81dc7385a7d04de57eec643a839499b3a4480f0ab0e46b0064c90cec88040a9847b49e05bda756aad6400b925ffddbd8c0a19dbfc6a391369f584c73bb04b528c956570fbedd1809b140593b7a636de98a0029d88eb65fe082288be0a7e6ca2517ba49f50e60c3993b425cf0c8c0bd92995b4925a189a1aa985a6f171094dd8f07c3e1f6896a881c5d69f4dfe095c3b36ff4fb9f3ed7795ad44adb158bef7dee3a42d8795f8663226e3722a247c4658f73e461f316e678b597c501c1591254d79fe5ebbc775941aeab45a5ae2eaf159c68e6c1c9f3718f06da75809c08ab4c531e461e4def76b02b193ed879898a4a18ddd0b04798be958ba4961146024064e63376066c57c21fe6f8da7bd4529822ca3042f937f32d99bc5be76a1886bcbc5808c7afef189a9d4d350743caf6dcf4d8d060255478c157d48bb85c3b86b482d75a432785aa90062de82f99bc7857f21b5504613bd36bb72d439b749642daec2b9107044eef7e0fd0cfa4b62685d37fa4c0891133e251cc69967ce242a2f3f84b640f9a62a920a95e4bfc34638280d01a01b87be4aa37335bbb7ad17c11954736020f491331cbc1a756eb8bb64a412421466b2c570eb771b4d5c165e8a554b344733aad94b6aff3d1c3b8f21d8799c2a80f74667c6e4a131ef835e0e288a95c4e99ba73107c91d4f4aa84392cb4fc70c254e3fdd803756aafc6b267c7f17ccbc174251c4ace0937ccd34d72fcbddcaac11255cb5f5ce6269d84a599bbe69e13d78293f0a41e70d0d1bc2138c9ac9ad231b95b9be064fa8bfeff4933493d6655dfd98aee1993342dd98f9e86f517d17c9de585fa97d569e7a414f859c967d7b673f7c889090b21503519a8d6f82bdb8e9073a011b4", 0x1000) 23:51:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x1c}, @fda={0x66646185, 0x6, 0x3d, 0x30}, @fda={0x66646185, 0x0, 0x1, 0x25}}, &(0x7f0000001300)={0x0, 0x28, 0x48}}}], 0x0, 0x0, 0x0}) 23:51:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x1, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) [ 1597.249996] binder: 3422:3426 got transaction to invalid handle [ 1597.259029] binder: 3424:3427 got transaction with fd, -1, but target does not allow fds [ 1597.267771] binder: 3420:3425 not enough space to store 0 fds in buffer 23:51:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000006c0)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000000)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fd, @fd}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, &(0x7f0000000640)}) 23:51:13 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x0, 0x1, 0x3}}, &(0x7f0000001300)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) signalfd(r1, &(0x7f00000000c0)={0x5d}, 0x8) [ 1597.267802] binder: 3420:3425 transaction failed 29201/-22, size 112-24 line 3475 [ 1597.268956] binder: undelivered TRANSACTION_ERROR: 29201 [ 1597.269003] binder: 3422:3426 transaction failed 29201/-22, size 112-24 line 3138 [ 1597.269326] binder: undelivered TRANSACTION_ERROR: 29201 [ 1597.270273] binder: 3422:3430 got transaction to invalid handle [ 1597.270282] binder: 3422:3430 transaction failed 29201/-22, size 112-24 line 3138 [ 1597.270473] binder: undelivered TRANSACTION_ERROR: 29201 [ 1597.306126] binder: 3433:3437 got transaction with invalid offset (87960930222080, min 40 max 112) or object. [ 1597.306153] binder: 3433:3437 transaction failed 29201/-22, size 112-24 line 3379 [ 1597.308950] binder: undelivered TRANSACTION_ERROR: 29201 [ 1597.334531] ------------[ cut here ]------------ [ 1597.334537] kernel BUG at drivers/android/binder_alloc.c:1108! [ 1597.334547] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1597.334554] Modules linked in: [ 1597.334566] CPU: 0 PID: 3439 Comm: syz-executor.3 Not tainted 4.9.194+ #0 [ 1597.334574] task: 000000003f60e32a task.stack: 00000000a0e1b0fe [ 1597.334599] RIP: 0010:[] [<000000003dbe3f1d>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 1597.334605] RSP: 0018:ffff8801a1d7f4a8 EFLAGS: 00010216 [ 1597.334611] RAX: 0000000000040000 RBX: 0000000020ffc000 RCX: ffffc90001f6a000 [ 1597.334618] RDX: 0000000000000407 RSI: ffffffff8223a8fb RDI: ffff8801c7b6f858 [ 1597.334624] RBP: ffff8801a1d7f528 R08: ffff8801a1d7f5a8 R09: 0000000000000008 [ 1597.334630] R10: ffffed00343aff12 R11: ffff8801a1d7f897 R12: 0000000000000078 [ 1597.334637] R13: 0000000000000250 R14: 0000000000000008 R15: ffff8801a1d7f5a8 [ 1597.334645] FS: 00007fdd00a52700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1597.334651] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1597.334658] CR2: 0000000000738008 CR3: 00000001d0d02000 CR4: 00000000001606b0 [ 1597.334667] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1597.334672] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 1597.334674] Stack: [ 1597.334688] ffffffff81249811 ffff8801a1d7f568 0000000000000246 0000000020001300 [ 1597.334699] ffff8801ca8b4028 ffff8801c78adfd8 00ff8801a1d7f870 ffff8801c78adf80 [ 1597.334710] ffffffff814fdcb6 ffff8801c7113800 0000000000000250 ffff8801a1d7f5a8 [ 1597.334712] Call Trace: [ 1597.334728] [<00000000bc39a28c>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1597.334738] [<0000000099bd65e3>] ? memcpy+0x46/0x50 [ 1597.334747] [<00000000dd8f5b5a>] binder_alloc_copy_from_buffer+0x37/0x42 [ 1597.334757] [<000000009c3ce95c>] binder_validate_ptr+0xc5/0x1b0 [ 1597.334766] [<00000000b7a64303>] ? binder_get_object+0x1b0/0x1b0 [ 1597.334774] [<00000000dd8f5b5a>] ? binder_alloc_copy_from_buffer+0x37/0x42 [ 1597.334783] [<00000000439837b3>] ? binder_get_object+0x12f/0x1b0 [ 1597.334790] [<000000000038ab43>] binder_transaction+0x20a4/0x5890 [ 1597.334800] [<0000000035d3ad47>] ? binder_inc_ref_for_node+0xba0/0xba0 [ 1597.334811] [<000000003dd816b1>] ? __save_stack_trace+0x7a/0xf0 [ 1597.334822] [<00000000407069c1>] ? depot_save_stack+0x13c/0x4a0 [ 1597.334829] [<00000000bc39a28c>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1597.334838] [<00000000c3934ea1>] ? __might_fault+0x114/0x1d0 [ 1597.334845] [<000000009f0420c5>] binder_thread_write+0x730/0x20e0 [ 1597.334854] [<00000000747621b1>] ? trace_hardirqs_on+0x10/0x10 [ 1597.334864] [<00000000ba1ae91d>] ? mark_wake_futex+0x120/0x120 [ 1597.334874] [<000000003eb3849f>] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 1597.334883] [<00000000370a8a5c>] ? binder_transaction+0x5890/0x5890 [ 1597.334892] [<00000000bc39a28c>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1597.334900] [<00000000bb093166>] binder_ioctl+0xecd/0x1720 [ 1597.334908] [<00000000bc39a28c>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1597.334915] [<00000000578fda48>] ? binder_poll+0x240/0x240 [ 1597.334922] [<0000000010d8d889>] ? __lock_acquire+0x5e0/0x4390 [ 1597.334932] [<00000000d2d3e57b>] ? __might_sleep+0x95/0x1a0 [ 1597.334940] [<00000000578fda48>] ? binder_poll+0x240/0x240 [ 1597.334951] [<00000000d72118ac>] do_vfs_ioctl+0xb87/0x11d0 [ 1597.334961] [<000000002df0bb5d>] ? selinux_file_ioctl+0x103/0x550 [ 1597.334970] [<00000000f9909abe>] ? ioctl_preallocate+0x210/0x210 [ 1597.334978] [<0000000028086a41>] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 1597.334987] [<00000000d7cefc8a>] ? __fget+0x208/0x370 [ 1597.334995] [<0000000050f12624>] ? __fget+0x22f/0x370 [ 1597.335003] [<0000000074bafe73>] ? __fget+0x47/0x370 [ 1597.335013] [<00000000a6a06478>] ? security_file_ioctl+0x8f/0xc0 [ 1597.335021] [<00000000336bd6fb>] SyS_ioctl+0x8f/0xc0 [ 1597.335029] [<000000004534c44c>] ? do_vfs_ioctl+0x11d0/0x11d0 [ 1597.335037] [<000000003f6240c5>] do_syscall_64+0x1ad/0x5c0 [ 1597.335047] [<00000000e17baebd>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1597.335177] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 0f 7e 0e ff 4d 39 e6 76 07 e8 05 7e 0e ff <0f> 0b e8 fe 7d 0e ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 ed [ 1597.335187] RIP [<000000003dbe3f1d>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 1597.335190] RSP [ 1597.335197] ---[ end trace 03b938d1316c2ce5 ]--- [ 1597.335204] Kernel panic - not syncing: Fatal exception [ 1597.335889] Kernel Offset: disabled [ 1597.809762] Rebooting in 86400 seconds..