00300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 865.141729] binder_alloc: binder_alloc_mmap_handler: 364 20001000-20004000 already mapped failed -16 [ 865.154564] binder: BINDER_SET_CONTEXT_MGR already set [ 865.160059] binder: 364:367 ioctl 40046207 0 returned -16 [ 865.166868] binder_alloc: 364: binder_alloc_buf, no vma [ 865.172814] binder: 364:371 transaction failed 29189/-3, size 0-0 line 3035 [ 865.180235] binder: 364:367 got reply transaction with no transaction stack 04:48:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 865.184748] overlayfs: failed to resolve './file1': -2 [ 865.187750] binder: release 364:367 transaction 1401 out, still active [ 865.199499] binder: undelivered TRANSACTION_COMPLETE [ 865.207471] binder: 364:367 transaction failed 29201/-71, size 0-0 line 2801 [ 865.214816] binder: undelivered TRANSACTION_ERROR: 29201 [ 865.220375] binder: send failed reply for transaction 1401, target dead [ 865.227372] binder: undelivered TRANSACTION_ERROR: 29201 [ 865.232951] binder: undelivered TRANSACTION_ERROR: 29189 04:48:09 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@nfc_llcp, &(0x7f0000000080)=0x80) clone(0x802182001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000005800)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}}}, &(0x7f0000005900)=0xe8) r3 = dup3(0xffffffffffffffff, r1, 0x80000) ioctl$VT_ACTIVATE(r3, 0x5606, 0xaf4) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d030100000000009500000000000000712600000000000035060000ff000000bf25000000000000070500000e0000000f65000000000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d43010000000000950000000000000061540000000000006b25000000000000070500000e0000000f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], r2}, 0x48) r4 = syz_open_dev$midi(&(0x7f0000000340)='/dev/midi#\x00', 0x0, 0x200000) bind$inet(r3, &(0x7f0000000300)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) exit(0xb0ffffff00000008) bind$netlink(0xffffffffffffffff, &(0x7f0000000180), 0xc) r5 = request_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000200)={'syz'}, &(0x7f0000000240)='GPL\x00', 0xffffffffffffffff) setsockopt$inet6_MRT6_DEL_MFC(r4, 0x29, 0xcd, &(0x7f0000000380)={{0xa, 0x4e23, 0x5, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7}, {0xa, 0x4e23, 0x6, @empty, 0x8}, 0x5, [0xe6, 0x0, 0xa8d, 0x6, 0xffffffffffffffff, 0x8, 0x10000, 0x6]}, 0x5c) keyctl$instantiate(0xc, r5, &(0x7f0000000280)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'GPL\x00'}, 0x2b, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000440)={0x0, 0x0, 0xffffffffffffffff}, &(0x7f00000004c0)=0x8) write$P9_RLCREATE(r3, &(0x7f00000002c0)={0x18, 0xf, 0x2, {{0x0, 0x3, 0x1}, 0x3}}, 0x18) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000640)={r6, 0x20, &(0x7f00000005c0)=[@in={0x2, 0x0, @rand_addr=0x100000000}, @in={0x2, 0x0, @remote}]}, &(0x7f0000000680)=0x10) write$P9_RREADDIR(r3, &(0x7f00000006c0)={0xa6, 0x29, 0x1, {0x4, [{{0x0, 0x2, 0x7}, 0x7, 0x1, 0x7, './file0'}, {{0x18, 0x3, 0x7}, 0x8, 0xffffffffffff0001, 0x7, './file0'}, {{0x4, 0x3, 0x3}, 0x6fed, 0x101, 0x7, './file0'}, {{0x1, 0x2, 0x8}, 0x101, 0x100000001, 0x7, './file0'}, {{0x40}, 0x4a0d, 0x5, 0x7, './file0'}]}}, 0xa6) connect$inet6(0xffffffffffffffff, &(0x7f0000000100), 0x1c) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x44000040}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x0, 0x0, 0x25dfdbfe}, 0x14}}, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="01797a21"], 0x4) [ 865.371407] binder: 379:381 got reply transaction with bad transaction stack, transaction 1406 has target 379:0 [ 865.385184] binder_alloc: binder_alloc_mmap_handler: 379 20001000-20004000 already mapped failed -16 [ 865.439727] binder: BINDER_SET_CONTEXT_MGR already set [ 865.466621] binder: 379:381 ioctl 40046207 0 returned -16 [ 865.502760] binder_alloc: 379: binder_alloc_buf, no vma [ 865.523181] binder: release 379:381 transaction 1406 out, still active [ 865.524944] binder: 379:381 got reply transaction with no transaction stack [ 865.540208] binder: undelivered TRANSACTION_COMPLETE [ 865.546234] binder: send failed reply for transaction 1406, target dead 04:48:10 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000004fc8)={&(0x7f0000016000), 0xc, &(0x7f000000b000)={&(0x7f000002c000)=@mpls_newroute={0x20, 0x18, 0x21, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x4, 0x12}]}, 0x20}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0x1, 0x4) 04:48:10 executing program 5: socketpair$unix(0x1, 0x40000000000002, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(0xffffffffffffffff, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) read$FUSE(0xffffffffffffffff, &(0x7f0000000200), 0x1000) 04:48:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 865.688213] device nr0 entered promiscuous mode [ 865.710031] binder: 403:405 got reply transaction with bad transaction stack, transaction 1411 has target 403:0 [ 865.731343] binder_alloc: binder_alloc_mmap_handler: 403 20001000-20004000 already mapped failed -16 [ 865.741865] binder: BINDER_SET_CONTEXT_MGR already set [ 865.753809] binder: 403:405 ioctl 40046207 0 returned -16 04:48:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 865.759533] binder_alloc: 403: binder_alloc_buf, no vma [ 865.769999] binder: release 403:405 transaction 1411 out, still active [ 865.780892] binder: undelivered TRANSACTION_COMPLETE [ 865.798034] binder: send failed reply for transaction 1411, target dead [ 865.841147] device nr0 entered promiscuous mode 04:48:10 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000, 0x7ffffffa) sched_setaffinity(0x0, 0x5, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0x8) fcntl$setflags(r2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000100), &(0x7f00000001c0)) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000100)={0x6, 0x2}) syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty=[0x2b], @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @local}, @gre={{0x0, 0x0, 0x1, 0x0, 0x3, 0xb}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}}}}}}, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000340)="025b15fafa53f7175db12b41cd9d72fe5bc357b7962ae65ff258db5c2e7d67eaffda1b9eb13412cf1b8a66e39017d11f1d6c34f32b92c1fbbe7bb5b2eb4d547477b301c43b4eb5e7380a4fcc19fe56955a88a6bd1d23f6ff980732ab1d721045da2c7ff2d779d25e04ae94a7d095364b6e02b884d8696ba5fe19a965477e2ab1bcbda946550cbcfea06bd7c46fe3afa4fac6546355f9e097aa4786912c9219b2f18d1edddab6efa885d8a6d4ea4b8a43f17c33121d5d8d7a5872c72eb0c50e7dfd5583f57f43cd") setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000200)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) write$P9_RFLUSH(r4, &(0x7f0000000300)={0x7, 0x6d, 0x2}, 0x7) sendfile(r4, r5, &(0x7f0000d83ff8)=0x1800, 0x8000fffffffe) [ 865.936963] binder: 408:409 got reply transaction with bad transaction stack, transaction 1415 has target 408:0 [ 866.037256] binder_alloc: binder_alloc_mmap_handler: 408 20001000-20004000 already mapped failed -16 [ 866.050309] binder: BINDER_SET_CONTEXT_MGR already set [ 866.096435] binder: 408:409 ioctl 40046207 0 returned -16 [ 866.096552] binder_alloc: 408: binder_alloc_buf, no vma [ 866.152783] binder: 408:409 got reply transaction with no transaction stack [ 866.282553] binder: send failed reply for transaction 1415 to 408:409 [ 866.289341] binder: undelivered TRANSACTION_COMPLETE 04:48:11 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x103) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@loopback, @in=@loopback}}, {{}, 0x0, @in=@empty}}, &(0x7f00000000c0)=0xe8) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2c6c6f7765726469723d2e3a66696c65302c776f726b646972873d"]) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000140)=""/65, 0x41) 04:48:11 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) r1 = getpid() syz_open_procfs(r1, &(0x7f0000000040)='net/llc\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000080)={0x7, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:11 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000, 0x7ffffffa) sched_setaffinity(0x0, 0x5, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0x8) fcntl$setflags(r2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000100), &(0x7f00000001c0)) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000100)={0x6, 0x2}) syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty=[0x2b], @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @local}, @gre={{0x0, 0x0, 0x1, 0x0, 0x3, 0xb}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}}}}}}, &(0x7f0000000000)) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000340)="025b15fafa53f7175db12b41cd9d72fe5bc357b7962ae65ff258db5c2e7d67eaffda1b9eb13412cf1b8a66e39017d11f1d6c34f32b92c1fbbe7bb5b2eb4d547477b301c43b4eb5e7380a4fcc19fe56955a88a6bd1d23f6ff980732ab1d721045da2c7ff2d779d25e04ae94a7d095364b6e02b884d8696ba5fe19a965477e2ab1bcbda946550cbcfea06bd7c46fe3afa4fac6546355f9e097aa4786912c9219b2f18d1edddab6efa885d8a6d4ea4b8a43f17c33121d5d8d7a5872c72eb0c50e7dfd5583f57f43cd") setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000200)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) write$P9_RFLUSH(r4, &(0x7f0000000300)={0x7, 0x6d, 0x2}, 0x7) sendfile(r4, r5, &(0x7f0000d83ff8)=0x1800, 0x8000fffffffe) [ 866.577476] overlayfs: unrecognized mount option "workdir‡=" or missing value [ 866.600456] binder: 424:427 got reply transaction with bad transaction stack, transaction 1420 has target 424:0 04:48:11 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:11 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 866.630485] overlayfs: unrecognized mount option "workdir‡=" or missing value [ 866.655929] binder_alloc: binder_alloc_mmap_handler: 424 20001000-20004000 already mapped failed -16 [ 866.701618] binder: BINDER_SET_CONTEXT_MGR already set 04:48:11 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'vlan0\x00', 0x10}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000008f00)={'tunl\x0e\x00'}) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000006000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f00000000c0)="0f0f1ba00873850f01d1ba4000b8a989ef660f2ac3ba4000b85700eff3cfbad00466b8b200000066ef3e0f38003abaf80c66b8a206ef8766efbafc0cec", 0x3d}], 0x1, 0x0, &(0x7f0000000200), 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000340)={0x6, 0x8001}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="65d9f3ba2000b0e1eed9ff66b8c4b800000f23c00f21f86635000005000f23f80f01d1baf80c66b8a322e48266efbafc0cb09dee6726670f32670fb2aec1cb0000ff22c02200", 0x46}], 0x1, 0x0, &(0x7f00000000c0), 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendto$llc(r0, &(0x7f0000000640)="862462a4bbc2da4b94249cb4063306055aea14c46c2103290d46596039f5ed56a839042d18b949c7b1fb423788f7dfd94b0283e46abf16c28c182956a0f4aa9645be446e15f7bcf0f885772553d315cd445638717b25f8fed9a33ae962e34a60329eeda5a081e24dd120a82001b02980a15e3e60cd35541a87378585ff7a9a04dfdbe70b5d52c2415bd42565beaad9b90a2a23b9e00696d53a095b4286ae592e62d065dbda440c12f0e645b71c0ac4c880063e476622be342b29f7e6a27aba7a953ff9b08b097aa1a1a58a399259d6a809306488540eed5b64b09378235f71eb9d2e5bbc28c6f437e9e819eaabb453ec0e82135244cc350e15bd15f0f86bccd45bcc9cfa64a3c99a02b060f55c29dc90fa7dfbb4ffa0a6eb74e8f3ce87e7f2b57a4a204dc9993d2abdf69095d2c768ed85b4faaa0303620ec31b2ee585d202e3a63b40b2f39d485949429bfcf524d091c4e72fb31f750cbfdd1825593f51441b5655258608ba950588bcd8a6bc377884b21b42cacf62f86abfbee334f9ad637e4d9245fa2582a8e1bf7856f356ebbce53e43b704b0ac5d2e5124687673d7c0e1ab8b224295a7ce76e2ff2a5eb049fd42d37efdfc8103c4dd60403ce0e67be5f64269bcbd488d7fab4055fda05700499423ffa9d15bfedd334df049c946d56842500f02b5d1cde76a8bb3ec9355f9c56fa19f015e0aa1b15c3659333fe7734e04711330991892732168a2a9a0a4d2d0cacc129fba13b1e5786f20566b8b4b3d2325b6943d6e3a7541bd628b703d17f8838d08cde4cf20ba2d27e23a695cb3fc42cb155f31b74162d8bf3460bdda6c3b260ab6b55585b0d081f7bc52c60c3f7056b5278bea75fac0a0e37acd2b8d46579f066b1a91a80ce3a34be21d119ba98d20bdb7495b831929a96602f56c2cd887af81d076b0ba3b4434f9e8cef6e8008101a483b2ccfb6d9c56b4c84abb4a89a40538e4fc9d678ea6a71a1ce98c41faaa2fe1c1239d7e645095fe09603e9010fb875581c98af39da806e2c6dbfd1af20428700a0a06231e3f3807725608731f8f736d73c9e3bb67a32274e7f57242ae282840067bdca216b3a2427c105049ab3bce0aaf5b96bcd7c69e4b60894c1b5f4d660ac5c32ac38e53871df95ae8c562f347538a3ee94b5b96daf150dbafcfaf0396b2e8c5f6abc357a41640cde51db0a00ac4de67a3feec507895d4255828a74197f2a7b01af94f4bd33157b2aeefe9d06ad4b1db8b8a1ce63589d64855137ffbd2e927b9e42be537a199dc78efd9049613d4b7624c5ee627ecc494e77a3f2ebb2deac183694d03958e7694e5c41bb89246e8d336d141082c7a6fd921890d8ea4fb5b5d6a0558fc932e64f3c2a5c4ba7f5c4b238bf2ff77ce1053e23d59ebf48e48199a7cef0c9b7e677e39ba31e8d7d7436c270ebbb3814c915c70e9cadf34003afe8fb65e8a8ade86219e45a6bc3ff1fca63d03fddf67f414e27f5cf7cb2ea27e37c76da3233b8207f44801e14c64f47065b3971e29a0c2a07867c3a0be2da44356563f0fb733c5218ddde430a9951ea435b447d0985c1f8efd497fb4596cb4111df4777f36710eb81b3f75ca2af9710daa9161c4cbdfc7baf487c33df92d0cf52168ee49c6005da3971447866d0b0389dab70b8804e6135e84d346d5a3d546622834e9198ec1bee7212551c2e77b54c6e4a016081a1e858d4bc85af1038b0f486d74bdaccc02a910f53c04aed0642eab6676ef12113c9fdf1181055d4f51db3d14957f0f0c29203412494f693272a30f198f4b372b50cf78504d2fa2326ad87bc61ef40a2950d70159a62b34538339391efb2d1ded3031f9a20b2b87a1666fd2bdc9db816130fdf31d43bded07c6b6f70001516041cc4165cdcf461bd3508d647a70baba3d69d9ca13ce6f37bf4da011b71f3afa775a563a08835026dfd1bd5eabb190eae64bfe620a0d99c960943bbfc0788b3456fc105919a58b902977607bd36dbc25531e66e5b44e70899fed745f805f513aa45cdb4ef472c3173570a1b6719faeb64c5c8a299f52b9648543df0b408fd7e706de3a54bb467d7a692813476e94ba0f5765f1b6e5fd774adbd4f6e3f9480048c8b23732e73d92172ecc3617d21f5a1af749dd39bc8971de62e664b0f476e2ddf53415e5c8f9c48f97eea08dd19cf9983bc0df460c35114a5bc4b0c14efcf0351355cb47da7b3039c3f87f959689018519805f96ec65b0ef4220c3bbf649bcdbf82f4050d55a9da8e1960fcf917df15dfbbf33c09e87002ff2aa94fa8c882c6e3c8afa353afc984f6bc0889fa16d7ec58455e177d84e2a0c66d0ce649caeae7051db5fe1e1670564f8021373862d1caf6fd90404a21a86d7f51ee8c52f6a8ce6c515bedf4c77ef2eb64431cab6bf6e096d6a7e692cd8a36cac5315d76ab96f46126beb87721f0712d03954fd00b80e0d59159755943111a874db35bdd8cf5986ef1f20e63ea83b7177e7ca174ce892c7492656cf462ec3ff23315511cedda85f000aa7620d025f14b3a8488ce4de90709eb41b360b1abbab0aecb5842ee7a513b6c04d2a0f672715d66a0c1d360ca8bd38bc66c083df29009ef1a3e50b859b12c2b9607117f2c300411e5dd7517558c8041964529a24c3cf1b84a5295eddb51caeca37840ece2a3399cb255a18809355be148b54dc6630ecd3a5f9a79acf8b6bf6b64f838304d6cb73d6a28c2d772f0fa04fcf7c249f540c2baef91474d88d5d7bb13ed1d3e8365a2883826236ea25c94f9edfd1adbcaeae7c5756e9eaf0bae563c3a487ec7dff823e6ab1c088fba3569211cef5950ce967a70bf815758bec650a696eb0fb1fc13a20d457092b95f4ada45505d434af31db5eeb474a769e22372424754a420a46f86fc5e7c7b07c93f4bc8a3447b4c666e55793b3891cbcc6974ed809d67d889525d41e332319e8f7fd78a877322886b102e9cc4e06663655716f70ee4dfd16f758ccd508750566a0935c9ff21cfb89d025e6a6ce524e33524efc19ff2d4c5eb35bbebb1277c55875f0dd8d1044b91f1885f74a8c745709b6a6ab895b65cf0c9ff4e4523a90309b54a5eb564d3be833f318eb369298d5ea52283fe09fa4d7c14735a23b7e8b916536891dae72dd58d4172904bc7d0eeb625861534ad41ace460c1a6f04f6f85668b53f3b453b7dd5168a66520dce4d6e376bf532f2f2b05c9a71e26abb7e7f42923a5c3f0f6d10ca81f7b659089a8673b77bbac36334524c23dee8208fb6fd09e5a78fa2a28da222e577f34c849d528020c3a660a712a666bcd9371fac90b4412aca1face62e9d078e3109000adb0cf2736ee61c988eb5db63f729e9b4e39beef9fd9e97c63f357cc1151a8921e6d753adc5a09e0302ff1f5a9d84cd2f33b330dea4f10318500a47070abe47733f405f6a6b2cb12bb71fabe035eef00468c28000c6ee621149df45f90d3de588374516cbae165e4cc7652eac343536490de30e2eb35642a4333ac99b9062ba4864dc684682e453543380ab8207b1f42a16968e7eb81676de9eb180ff32dfbf69ab91c7e2d3acf58ac8be81abe1fd3cf599fcc59e470c44016e164fb1a79c9163cff357d0f0b50e7de041f900dc1f3adb6bd0719880cb59a235e20efad25a407678a0eec4ca0b53472a7a1f2268b55dfe44264e247755b72e9da7b25023814218c1063f2e90d5881a9629bdc9c951dd571306a2e720133c216dc3650d3f561431fe5939113021c20d10823fc2ba84e071e89754e6a2812bd24bb7c68640f51781b84f6ff775f3ca0cefcd93dd2cdedc7b9658295767e4d5295ddfa65de31fba3f0bcef9d571365e515e47f53c51d912eefe3cabb65e0ab65168c2eefed11adb059b5c17617db07041d17f997df64e1dccbf2935de375f726499eca0c308fffb819e6d9f442563a0d1446dbd1ff31731f9fadc2c1c87bf0242c6b1f275c4cd34ce8d6fe617c786ede4a646d796e649d80fef61598d590d64805b39151129e0dcb7ea5633c9fad4152dbc03291a14425f366ecf08a40306508fc5ff91aa88bac32c4cb35dba19a947a9def94223328e3dc19703987a8acfe4f62b60abb480225a78de86be1ea1e3767174b9e643f65fe6ca2e083fe0a0d3c450af3368b7b506097dc469b7178d02293d78b273a0bd5fa1a835f97a3a1622d9f8a9f65cc4e62de9b88789cb983e847d63df39439e86ccd39edafac8f77409fc9e86da090a56dbfbf9c551ea7157fc0eb951871d8c839f4a0eb8cc3abb5280c8c04c1987a33c3ec25d0d1f94a10ae88a2a8444cdd5b2f80463441f6e66338775e9b18966ca5dd9a0693f10a7db33e60bc9a7f45d26aafa1642b29c9e996e092a201e6fe168f9a1923cec57a7db72ad61970006bb1dc21e0bf24e79d5ece070b3b3df3d035cfad4ac0bc835b2dc50f890184d47ab73a7c5af5c291152a4c65eaab6bf2dabe9c0c3f10cb4efd4882f984dc438256187d4bafec5484f1e3fe9fb86ab5482b4b99d36d55e6b1dcc09ebf41aeecace56d06d13054ea3128d2e6c4431c6e42b029722007763ae75270b0f9f3d6f2266c02616c484fcbf2970ecab7aa6ea27444782f49bfdd1f8130bf91936160d21c69dc38f374de4901a388cf382ce5971180e5d819a21025e28c3b0ae1c8db78ee0f6b48218ba58b63776fb85df11e80a2ba2b0f56d370f323df5df9c92d8d431a7c6b7a470c79ea5ebc706e5e937748c96f32e4185ffb29ec9fd1b4ade4bfca0b8edd8b7176e51662135df3ae411fb84a1cac41cbe9faa60eebefa508042f8219c5cf7732bcea6e7f452399c523b57ca40bc7040dc933dcc0f29192bb44251fc97c4913298d2e16e0d7d2d969418a9fd4d378b68b072e81c7c191913ff2843af7d9dc9fcfd6d442e73c1cf103b83dfee5b78de8a3040510201cca7d8b3ee10c0274f34255fc10f6747efb2dbf39669d0cd1b4049713c63827d4712cf22ec1aa40e873de1da662cd937f3acccdd86c541897d53ca99b5114d4831c58e1cc0470be4b8cbbc234357fcd862dad2881537aeeba5dde16bd141e181cfb4800343f0214dc9297dc80b110afa3469e899315faf3ab11c939f698def905d1f03f4a389fca92276ce8b94b87ed984509c129f9815275c291779747b70fac240c8c50e963f51767cbc2122e3c9ce54f182c56af3828767bad013940eb78ed0851fa81be34b2867676a571e45d96aa9972355d561c0de00bd33c4d5be3815e9efdaf82c19afb96bf9a974a2c061f168f989c7b20880b3d9979da808357ae05011c8a154d1269ace20a33a8d696254a59305836aae3d6b1010f8176c76fe3bd01f4b28b8ce8e3255effb473785b2a1bc310d56ce409d58c72473b739d149a541dfa0e6cc51949759ea67cfe75924db779e09c0e2a5730e7cdbcb3486f2cc24e3717910f7379d6e11bca26668906b526e7b2e26ee6a3569d0bdc47a99042515f34da0ffa752254dfd4154e083faa7271c50a1d14d14a10a07a311ef8ef3e04289336d29c92d780bdbdf42d1d22ab2e7f64820daad18c1e2016ceaf4315420beaef1835b9a9b9a483f0c2a97b23af97e95b66e571ca77a3f56a8ed6a09bc0fd786f3766e527519aeb6b7d5a1163bdf6ef524d4ebf3b0ba797d88b8481e03ae1febb87acbbfd3a4ddaa4dc36b4eef2acc1aec6404f81f11e30a0efc377759798c6dd04848d4664502fc42a8caf9da847c6866b364d1b61cc5bdbe9f6d305302ccbad03036997dbe3a21c322e0fc68450b75511b24c6bbac0c76e41ba821e95af1824f52f7d0a2ccc342a23a8d43ed39bc", 0x1000, 0x24040810, &(0x7f0000000100)={0x1a, 0x335, 0x6, 0x4, 0x2, 0x10000, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}}, 0x10) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x1000000000002, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000600)={'ip_vti0\x00', 0x201e}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001fc0)={'ip_vti0\x00', 0x0}) write$P9_RCLUNK(r2, &(0x7f0000000200)={0x7, 0x79, 0x2}, 0x7) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000340)={@remote, 0x1, r9}) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000080)={@dev, r9}, 0x14) [ 866.739436] binder: 424:427 ioctl 40046207 0 returned -16 [ 866.811457] binder_alloc: 424: binder_alloc_buf, no vma [ 866.856412] binder: send failed reply for transaction 1420 to 424:427 [ 866.865708] binder: undelivered TRANSACTION_COMPLETE 04:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 866.998023] binder: 454:455 got reply transaction with bad transaction stack, transaction 1424 has target 454:0 [ 867.018467] binder_alloc: binder_alloc_mmap_handler: 454 20001000-20004000 already mapped failed -16 [ 867.031832] binder: BINDER_SET_CONTEXT_MGR already set [ 867.040119] binder: 454:455 ioctl 40046207 0 returned -16 04:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 867.049654] binder_alloc: 454: binder_alloc_buf, no vma [ 867.058215] binder: release 454:455 transaction 1424 out, still active [ 867.070628] binder: undelivered TRANSACTION_COMPLETE [ 867.089649] binder: send failed reply for transaction 1424, target dead [ 867.101169] kvm: pic: level sensitive irq not supported [ 867.129456] kvm: pic: level sensitive irq not supported [ 867.157441] device nr0 entered promiscuous mode 04:48:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x4c49, 0xe970, 0x5, 0x7f, 0x0, 0x569197cb, 0x8, 0xc, 0x0, 0x200, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6, 0x384, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x101, 0x2, 0x0, 0x0, 0x5, 0x22, 0x0, 0x0, 0x100000000, 0x0, 0x80000000, 0x7f, 0x0, 0x9d8, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff, 0x0, 0x20, 0x0, 0x7}, r1, 0x0, r0, 0x0) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x0, 0x80000000}) mq_timedreceive(r2, &(0x7f0000000200)=""/244, 0xfffffff8, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) mq_timedsend(r2, &(0x7f0000000040), 0x0, 0x0, 0x0) [ 867.177160] binder: 457:458 got reply transaction with bad transaction stack, transaction 1428 has target 457:0 [ 867.209842] binder_alloc: binder_alloc_mmap_handler: 457 20001000-20004000 already mapped failed -16 04:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 867.232797] binder: BINDER_SET_CONTEXT_MGR already set [ 867.238419] binder: 457:458 ioctl 40046207 0 returned -16 [ 867.238800] binder_alloc: 457: binder_alloc_buf, no vma [ 867.250698] binder: release 457:458 transaction 1428 out, still active [ 867.258621] binder: undelivered TRANSACTION_COMPLETE [ 867.264792] binder: send failed reply for transaction 1428, target dead [ 867.268530] device nr0 entered promiscuous mode 04:48:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x4c49, 0xe970, 0x5, 0x7f, 0x0, 0x569197cb, 0x8, 0xc, 0x0, 0x200, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6, 0x384, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x101, 0x2, 0x0, 0x0, 0x5, 0x22, 0x0, 0x0, 0x100000000, 0x0, 0x80000000, 0x7f, 0x0, 0x9d8, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff, 0x0, 0x20, 0x0, 0x7}, r1, 0x0, r0, 0x0) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x0, 0x80000000}) mq_timedreceive(r2, &(0x7f0000000200)=""/244, 0xfffffff8, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) mq_timedsend(r2, &(0x7f0000000040), 0x0, 0x0, 0x0) 04:48:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:11 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f00000023c0), 0x652) [ 867.346384] binder: BINDER_SET_CONTEXT_MGR already set [ 867.353058] binder_alloc: 464: binder_alloc_buf, no vma [ 867.358956] binder: 464:465 ioctl 40046207 0 returned -16 [ 867.365847] binder: release 464:465 transaction 1432 out, still active [ 867.374522] binder: send failed reply for transaction 1432, target dead 04:48:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x4c49, 0xe970, 0x5, 0x7f, 0x0, 0x569197cb, 0x8, 0xc, 0x0, 0x200, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6, 0x384, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x101, 0x2, 0x0, 0x0, 0x5, 0x22, 0x0, 0x0, 0x100000000, 0x0, 0x80000000, 0x7f, 0x0, 0x9d8, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff, 0x0, 0x20, 0x0, 0x7}, r1, 0x0, r0, 0x0) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x0, 0x80000000}) mq_timedreceive(r2, &(0x7f0000000200)=""/244, 0xfffffff8, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) mq_timedsend(r2, &(0x7f0000000040), 0x0, 0x0, 0x0) [ 867.520343] binder: BINDER_SET_CONTEXT_MGR already set [ 867.531009] binder: 473:474 ioctl 40046207 0 returned -16 04:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 867.629338] binder: send failed reply for transaction 1436 to 473:474 [ 867.674126] binder: BINDER_SET_CONTEXT_MGR already set [ 867.694877] binder: 480:481 ioctl 40046207 0 returned -16 [ 867.694924] binder: send failed reply for transaction 1440 to 480:481 [ 867.754593] raw_sendmsg: syz-executor.1 forgot to set AF_INET. Fix it! 04:48:12 executing program 4: open(0x0, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000080)='./file1\x00', 0x400042, 0x0) keyctl$set_reqkey_keyring(0xe, 0x0) close(r0) recvfrom$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001f00)) geteuid() ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) getpeername(0xffffffffffffffff, 0x0, 0x0) 04:48:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x4c49, 0xe970, 0x5, 0x7f, 0x0, 0x569197cb, 0x8, 0xc, 0x0, 0x200, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6, 0x384, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x101, 0x2, 0x0, 0x0, 0x5, 0x22, 0x0, 0x0, 0x100000000, 0x0, 0x80000000, 0x7f, 0x0, 0x9d8, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff, 0x0, 0x20, 0x0, 0x7}, r1, 0x0, r0, 0x0) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x0, 0x80000000}) mq_timedreceive(r2, &(0x7f0000000200)=""/244, 0xfffffff8, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) mq_timedsend(r2, &(0x7f0000000040), 0x0, 0x0, 0x0) 04:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:12 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:12 executing program 1: capset(&(0x7f0000a31000)={0x19980330}, &(0x7f00009b3000)) pivot_root(0x0, 0x0) [ 868.030145] binder: BINDER_SET_CONTEXT_MGR already set 04:48:12 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='bpf\x00', 0x220040, &(0x7f0000001200)={[{@mode={'mode', 0x3d, 0x80000001}}, {@mode={'mode', 0x3d, 0x1f}}, {@mode={'mode', 0x3d, 0x17}}, {@mode={'mode', 0x3d, 0xffff}}, {@mode={'mode', 0x3d, 0x7fff}}, {@mode={'mode'}}, {@mode={'mode', 0x3d, 0x10000}}, {@mode={'mode', 0x3d, 0x73}}], [{@fscontext={'fscontext', 0x3d, 'user_u'}}]}) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000040)=0x7f) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:12 executing program 2: r0 = open(&(0x7f0000000140)='.\x00', 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0xfffffffffffffe5b) r1 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x6685) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x4c6) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) fallocate(r0, 0x11, 0x3, 0x8) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) tkill(r1, 0x1000000000016) [ 868.074239] binder: 487:493 ioctl 40046207 0 returned -16 [ 868.108230] binder: release 487:493 transaction 1444 out, still active 04:48:12 executing program 4: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f00000000c0)='/', 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0) ppoll(&(0x7f0000000040)=[{}], 0x1, 0x0, &(0x7f0000000180)={0xb959}, 0x8) 04:48:12 executing program 1: ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000280)) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) eventfd(0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) syncfs(r0) msgget$private(0x0, 0x0) [ 868.120726] binder: send failed reply for transaction 1444, target dead 04:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0xfffffffffffffffd, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000080)=@security={'security\x00', 0xe, 0x4, 0x4e8, 0x460, 0x138, 0x460, 0x138, 0x460, 0x638, 0x638, 0x638, 0x638, 0x638, 0x4, 0x0, {[{{@uncond, 0x0, 0xc8, 0x138}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "84cfea1d3663e747b0fea8d88188d692cede9a68177257dff570081d7c574fe3f4f3d86bd481bc3c4e61c84e8400fc20bfa68e2f97574265f297cb9b5035e4ef"}}}, {{@ipv6={@dev, @mcast1, [], [], 'ifb0\x00', 'team_slave_0\x00'}, 0x0, 0xc8, 0x1f0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:sshd_exec_t:s0\x00'}}}, {{@ipv6={@ipv4={[], [], @dev}, @mcast1, [], [], '\x00', 'nlmon0\x00'}, 0x0, 0xc8, 0xf0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x548) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0xa, &(0x7f0000000000), 0x4) [ 868.314509] binder: BINDER_SET_CONTEXT_MGR already set [ 868.344068] binder: 517:518 ioctl 40046207 0 returned -16 04:48:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000200)={0x8000, {{0x2, 0x4e22, @multicast1}}}, 0x88) sendto(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 04:48:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 868.431174] binder: BINDER_SET_CONTEXT_MGR already set [ 868.440419] binder: 525:526 ioctl 40046207 0 returned -16 [ 868.560587] binder: BINDER_SET_CONTEXT_MGR already set 04:48:13 executing program 1: mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0xfffffffffffffffd, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x5, &(0x7f0000000000), 0x4) [ 868.592615] binder: 532:533 ioctl 40046207 0 returned -16 [ 868.593521] binder: send failed reply for transaction 1456 to 532:533 [ 868.626474] device nr0 entered promiscuous mode 04:48:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write(r1, &(0x7f0000000380)="248a89f145541bcfc255b50bbb186434", 0x10) io_setup(0x1, &(0x7f0000479000)=0x0) io_submit(r2, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000340)="16", 0x1}]) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 04:48:13 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:13 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r8, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 868.958771] binder_transaction: 7 callbacks suppressed [ 868.958786] binder: 543:547 got reply transaction with bad transaction stack, transaction 1460 has target 543:0 [ 868.979938] binder_transaction: 28 callbacks suppressed [ 868.979956] binder: 543:547 transaction failed 29201/-71, size 0-0 line 2816 [ 869.004627] binder: BINDER_SET_CONTEXT_MGR already set [ 869.011001] binder: 543:547 ioctl 40046207 0 returned -16 [ 869.011149] binder: 543:548 transaction failed 29189/-3, size 0-0 line 3035 [ 869.024853] binder: 543:547 got reply transaction with no transaction stack [ 869.032691] binder: 543:547 transaction failed 29201/-71, size 0-0 line 2801 04:48:13 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) clone(0x201, 0x0, 0x0, 0x0, 0x0) syz_execute_func(&(0x7f0000000200)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = creat(&(0x7f00000004c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x54c3a6f4a30b4042) r3 = dup2(r1, r2) execve(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x80000841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)}, 0x0) 04:48:13 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) ppoll(&(0x7f0000000140)=[{r0}], 0x1, 0x0, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r1) 04:48:13 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) clone(0x201, 0x0, 0x0, 0x0, 0x0) syz_execute_func(&(0x7f0000000200)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000100)='./file1\x00', 0x91) r2 = creat(&(0x7f00000004c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x54c3a6f4a30b4042) r3 = dup2(r1, r2) execve(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x80000841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)}, 0x0) 04:48:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 869.221600] binder: 568:569 got reply transaction with bad transaction stack, transaction 1465 has target 568:0 [ 869.233921] binder: 568:569 transaction failed 29201/-71, size 0-0 line 2816 [ 869.259772] binder_alloc_mmap_handler: 8 callbacks suppressed [ 869.259797] binder_alloc: binder_alloc_mmap_handler: 568 20001000-20004000 already mapped failed -16 [ 869.292748] binder: BINDER_SET_CONTEXT_MGR already set [ 869.298313] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 869.298321] binder_alloc: 568: binder_alloc_buf, no vma [ 869.314701] binder: 568:569 ioctl 40046207 0 returned -16 [ 869.322999] binder: 568:573 transaction failed 29189/-3, size 0-0 line 3035 [ 869.335292] binder_thread_release: 3 callbacks suppressed 04:48:13 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xfffffffffffffffc, 0x0, @mcast2, 0x20000000002}, 0x1c) openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x1f5, 0x20007ffc) connect$ax25(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @bcast, 0x4}, [@netrom, @remote, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @null, @null]}, 0x48) [ 869.335303] binder: release 568:569 transaction 1465 out, still active [ 869.340021] device nr0 entered promiscuous mode [ 869.340969] binder_release_work: 8 callbacks suppressed [ 869.340974] binder: undelivered TRANSACTION_COMPLETE [ 869.340992] binder_release_work: 36 callbacks suppressed [ 869.340997] binder: undelivered TRANSACTION_ERROR: 29201 04:48:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d72b070") mknod$loop(&(0x7f00000002c0)='./file0\x00', 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf74, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000380)='./file0\x00', 0x40002, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000240)='./file0\x00', 0x90002) sendfile(r1, r2, 0x0, 0x0) [ 869.468273] binder: undelivered TRANSACTION_ERROR: 29189 [ 869.488777] binder_send_failed_reply: 3 callbacks suppressed [ 869.488784] binder: send failed reply for transaction 1465, target dead [ 869.577739] binder: 590:591 got reply transaction with bad transaction stack, transaction 1469 has target 590:0 [ 869.601117] binder: 590:591 transaction failed 29201/-71, size 0-0 line 2816 [ 869.621879] binder_alloc: binder_alloc_mmap_handler: 590 20001000-20004000 already mapped failed -16 [ 869.634453] binder: BINDER_SET_CONTEXT_MGR already set [ 869.639914] binder: 590:591 ioctl 40046207 0 returned -16 [ 869.657275] binder_alloc: 590: binder_alloc_buf, no vma [ 869.671400] kauditd_printk_skb: 280 callbacks suppressed [ 869.671415] audit: type=1804 audit(1551847694.201:372): pid=595 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir620796598/syzkaller.KZiDP9/542/file0" dev="sda1" ino=16589 res=1 [ 869.704082] binder: release 590:591 transaction 1469 out, still active [ 869.712617] binder: 590:593 transaction failed 29189/-3, size 0-0 line 3035 [ 869.719948] binder: undelivered TRANSACTION_COMPLETE 04:48:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000100), 0x12) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000000400)=""/4096, 0x12d8}], 0x1, 0x0) [ 869.732151] binder: undelivered TRANSACTION_ERROR: 29201 [ 869.745378] binder: undelivered TRANSACTION_ERROR: 29189 04:48:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 869.783292] binder: send failed reply for transaction 1469, target dead [ 869.859777] binder: 600:601 got reply transaction with bad transaction stack, transaction 1473 has target 600:0 04:48:14 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) r1 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x10000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f0000005b40), 0x40000000000014d, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) 04:48:14 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0xffffffffffffffc6) sendto(r1, &(0x7f0000000040)="d48e4b9d365400cc433cfbd36b2f03bb2926857d550de77e74c0e08b81cfc077eb141bd9b72b39afd9d5d79293a133d682a91046ee600f72f4451f4458825a9eaebcc8cf1889b61b4bd7f3ae3c8cdd2e3441b194c8a0310711922ee7b233f74592ee5a87c5e6e6f11dd5f16076ff1914c457ac49c3add35b73", 0x79, 0xc000, &(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x6, @rand_addr="81728904d5edb41dc3df87353fcabce8", 0x7}, 0x80) [ 869.937304] binder: 600:601 transaction failed 29201/-71, size 0-0 line 2816 [ 869.988088] binder_alloc: binder_alloc_mmap_handler: 600 20001000-20004000 already mapped failed -16 [ 870.021144] binder: BINDER_SET_CONTEXT_MGR already set [ 870.037422] binder: 600:601 ioctl 40046207 0 returned -16 [ 870.050214] binder_alloc: 600: binder_alloc_buf, no vma [ 870.056187] binder: 600:605 transaction failed 29189/-3, size 0-0 line 3035 [ 870.070964] binder: 600:601 got reply transaction with no transaction stack [ 870.078445] binder: release 600:601 transaction 1473 out, still active [ 870.092688] binder: 600:601 transaction failed 29201/-71, size 0-0 line 2801 [ 870.100085] binder: undelivered TRANSACTION_COMPLETE [ 870.112103] binder: undelivered TRANSACTION_ERROR: 29201 [ 870.130994] binder: undelivered TRANSACTION_ERROR: 29201 [ 870.148501] binder: undelivered TRANSACTION_ERROR: 29189 [ 870.168702] binder: send failed reply for transaction 1473, target dead [ 870.216216] audit: type=1804 audit(1551847694.751:373): pid=594 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir620796598/syzkaller.KZiDP9/542/file0" dev="sda1" ino=16589 res=1 [ 870.273942] audit: type=1804 audit(1551847694.771:374): pid=594 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir620796598/syzkaller.KZiDP9/542/file0" dev="sda1" ino=16589 res=1 04:48:14 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r8, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:14 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xfffffffffffffffc, 0x0, @mcast2, 0x20000000002}, 0x1c) openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x1f5, 0x20007ffc) connect$ax25(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @bcast, 0x4}, [@netrom, @remote, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @null, @null]}, 0x48) 04:48:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write(r1, &(0x7f0000000380)="248a89f145541bcfc255b50bbb186434eb", 0x11) io_setup(0x1, &(0x7f0000479000)=0x0) io_submit(r2, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000340)="16", 0x1}]) [ 870.373092] binder: 615:617 got reply transaction with bad transaction stack, transaction 1478 has target 615:0 [ 870.455262] binder_alloc: binder_alloc_mmap_handler: 615 20001000-20004000 already mapped failed -16 [ 870.512058] binder_alloc: 615: binder_alloc_buf, no vma [ 870.522523] protocol 88fb is buggy, dev hsr_slave_0 [ 870.527665] protocol 88fb is buggy, dev hsr_slave_1 [ 870.538638] binder: BINDER_SET_CONTEXT_MGR already set [ 870.591204] binder: 615:617 ioctl 40046207 0 returned -16 [ 870.592989] binder: send failed reply for transaction 1478 to 615:617 04:48:15 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0xffffff57, 0x0, 0x0, &(0x7f0000000280)=""/240, 0xf0}, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x6, 0x0, @buffer={0x13, 0xee, &(0x7f00000002c0)=""/238}, &(0x7f00000000c0)="da88aa5af197", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}) 04:48:15 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) lsetxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@md5={0x1, "68efb7f4ec9abd0fc7cbb1ad1e1f8235"}, 0x11, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x80, 0x0) read$FUSE(r2, &(0x7f00000013c0), 0x10b8) [ 870.634844] binder: undelivered TRANSACTION_COMPLETE [ 870.661403] binder: undelivered TRANSACTION_ERROR: 29201 [ 870.688892] binder: undelivered TRANSACTION_ERROR: 29189 04:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 870.726025] binder: undelivered TRANSACTION_ERROR: 29189 04:48:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(0xffffffffffffffff, 0x0, 0x0) r2 = gettid() ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) r3 = dup2(r0, r1) shmctl$SHM_INFO(0x0, 0xe, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) write$P9_RLCREATE(0xffffffffffffffff, 0x0, 0x1d6caed95f5f079) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key(0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) write$P9_RREADDIR(r3, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) tkill(r2, 0x1000000000016) [ 870.851886] binder: 640:642 got reply transaction with bad transaction stack, transaction 1482 has target 640:0 [ 870.912482] binder_alloc: binder_alloc_mmap_handler: 640 20001000-20004000 already mapped failed -16 [ 870.922710] protocol 88fb is buggy, dev hsr_slave_0 [ 870.928102] protocol 88fb is buggy, dev hsr_slave_1 [ 870.934021] protocol 88fb is buggy, dev hsr_slave_0 [ 870.939551] protocol 88fb is buggy, dev hsr_slave_1 [ 870.945600] protocol 88fb is buggy, dev hsr_slave_0 [ 870.951011] protocol 88fb is buggy, dev hsr_slave_1 [ 870.959394] binder_alloc: 640: binder_alloc_buf, no vma [ 870.959455] binder: BINDER_SET_CONTEXT_MGR already set 04:48:15 executing program 2: write$FUSE_LK(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x197) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000100)={0x80033d, 0x20000000209, 0x0, 0xffffffffffffffff}) r2 = dup2(r0, r1) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000000)={0x9cf0000008, 0x9}) [ 871.022540] binder: 640:642 ioctl 40046207 0 returned -16 [ 871.033535] binder: release 640:642 transaction 1482 out, still active [ 871.047460] binder: undelivered TRANSACTION_COMPLETE [ 871.066614] device nr0 entered promiscuous mode 04:48:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 871.082894] protocol 88fb is buggy, dev hsr_slave_0 [ 871.088281] protocol 88fb is buggy, dev hsr_slave_1 [ 871.107054] binder: send failed reply for transaction 1482, target dead [ 871.178423] binder: 652:653 got reply transaction with bad transaction stack, transaction 1486 has target 652:0 04:48:15 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) r1 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x10000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f0000005b40), 0x40000000000014d, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) 04:48:15 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00\x00\x00\x00\x00\x01\x00'}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="080008008402000014000100fe8000000000000000000000000000aa77eb5091ccabf34fd7e1939204bc4b18aecd7e785f124b14a0e6ada9c5f9ca248a4ee440208b7057a7efa7cca661a6cc6da59bd8f81e2a0e19ef3fde299c4ef12db5e436be8a6c95e5a2ab695fd1a0beedaa7e4361946e6c3db8d3420e7480a63c779b3370ba985b27a70ee8c0ae6ed106d0652cf909efdede66acf7079c59a10748776c6c3efcbd7fa4b35788db95f1f2533e5cbeadad5fa23c6d3cf2bfe80839d7993a780e7a236602491a285155bc5241d0696cdf4680da8c8bd9f0540e4d5683123dfdb69d3802ba2122e7005e03d346ae4d1c96d75010850dfcb83205c74c4bccf54b68b21c5bbc0707188893d6149048d3372b336fef3bab2955b728350c1aef81847621234b970f04db0f18f285a24dedd2c0789b915c179ed524663b7f17b9b8c03c9ca1b66988e6d4653e046aecc8af27b8d776d3e9a16f961b199708cd0223e39a01df57e185419ebc6ecb428c2c6ee6d0d0e7e77d335295052a927ed4d4b45c23effe7c926d269d587e4e21f0f8cd0e174182b8fb51e5422daed027ef760c4f4b01f782a5889c66937b42070de0866c93497ce2d302512349b7cff0371b6eaa0e0da23f7e9441ea20ac57b29ee07a787668ac479b5ad54788f6148500fdd57865d01401e5c4"], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x0) [ 871.219199] binder_alloc: binder_alloc_mmap_handler: 652 20001000-20004000 already mapped failed -16 [ 871.236430] binder: BINDER_SET_CONTEXT_MGR already set [ 871.243575] binder: 652:653 ioctl 40046207 0 returned -16 [ 871.262323] binder_alloc: 652: binder_alloc_buf, no vma [ 871.291024] binder: release 652:653 transaction 1486 out, still active [ 871.312838] binder: undelivered TRANSACTION_COMPLETE [ 871.344652] binder: send failed reply for transaction 1486, target dead 04:48:16 executing program 2: r0 = socket(0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x34d0059d5decbfec) r1 = gettid() r2 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) capget(&(0x7f0000000000), 0x0) lseek(r0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$setflags(r2, 0x2, 0x1) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) tkill(r1, 0x1000000000016) 04:48:16 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000001fb8)={0x1, 0x4, &(0x7f0000003000)=ANY=[@ANYBLOB="ff00000000000000000000000000000004000000000000009500000000000000"], 0x0, 0x4, 0xe7, &(0x7f0000002f19)=""/231}, 0x48) 04:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:16 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:16 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r8, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:16 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000180)=@ethtool_ringparam={0x10}}) 04:48:16 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write(r1, &(0x7f0000000380)="248a89f145541bcfc255b50bbb186434", 0x10) io_setup(0x1, &(0x7f0000479000)=0x0) io_submit(r2, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000340)="16", 0x1}]) [ 871.624796] binder: 671:674 got reply transaction with bad transaction stack, transaction 1490 has target 671:0 [ 871.691759] binder_alloc: binder_alloc_mmap_handler: 671 20001000-20004000 already mapped failed -16 04:48:16 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x3}, 0x329) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x131, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xfffffffffffffe9a) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000)) [ 871.741021] binder: BINDER_SET_CONTEXT_MGR already set 04:48:16 executing program 2: r0 = socket(0x10, 0x80002, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) dup3(r1, r0, 0x0) [ 871.772020] binder: 671:674 ioctl 40046207 0 returned -16 [ 871.791087] binder: release 671:674 transaction 1490 out, still active [ 871.798687] binder_alloc: 671: binder_alloc_buf, no vma [ 871.805385] binder: undelivered TRANSACTION_COMPLETE 04:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 871.828360] binder: send failed reply for transaction 1490, target dead [ 871.884955] device nr0 entered promiscuous mode 04:48:16 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000500)={0x0, 0xffffffff}) 04:48:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'rmd256\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000002480), 0xed, 0x0, &(0x7f00000001c0)={0x77359400}) 04:48:16 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) syz_execute_func(&(0x7f0000000080)="3666440f50f564ff0941c366440f56c9c4c27d794e0066420fe2e3f347aac442019dccd3196f") clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair(0x2, 0x0, 0x0, 0x0) clone(0x1ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = creat(&(0x7f0000000240)='./file0\x00', 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) write$cgroup_type(r0, &(0x7f0000001380)='threaded\x00', 0xd4b9c80) fchown(r0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000000c0)={0x4, 0x401, 0x0, 0x400}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = creat(&(0x7f0000000100)='./file1\x00', 0x27) r3 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in=@remote, @in=@broadcast}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) dup2(r1, r3) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(0x0, 0x0, 0x0) [ 871.912073] binder: 699:701 got reply transaction with bad transaction stack, transaction 1494 has target 699:0 [ 871.941866] binder_alloc: binder_alloc_mmap_handler: 699 20001000-20004000 already mapped failed -16 [ 871.981772] binder: BINDER_SET_CONTEXT_MGR already set [ 872.029245] binder: release 699:701 transaction 1494 out, still active [ 872.036595] binder: 699:701 ioctl 40046207 0 returned -16 [ 872.044814] audit: type=1804 audit(1551847696.581:375): pid=710 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir551565307/syzkaller.dvcAOz/39/bus" dev="sda1" ino=16721 res=1 [ 872.050216] binder: undelivered TRANSACTION_COMPLETE 04:48:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) getpeername(r0, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000000)=0x361) keyctl$clear(0x7, 0x0) r2 = dup2(r0, r1) fstat(0xffffffffffffffff, 0x0) writev(r2, 0x0, 0x0) 04:48:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 872.129141] binder: send failed reply for transaction 1494, target dead [ 872.165803] audit: type=1804 audit(1551847696.601:376): pid=710 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir551565307/syzkaller.dvcAOz/39/bus" dev="sda1" ino=16721 res=1 [ 872.211546] binder: 717:719 got reply transaction with bad transaction stack, transaction 1497 has target 717:0 [ 872.280445] binder_alloc: binder_alloc_mmap_handler: 717 20001000-20004000 already mapped failed -16 [ 872.287639] audit: type=1804 audit(1551847696.601:377): pid=712 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir551565307/syzkaller.dvcAOz/39/bus" dev="sda1" ino=16721 res=1 [ 872.318032] binder: BINDER_SET_CONTEXT_MGR already set [ 872.327975] binder: 717:719 ioctl 40046207 0 returned -16 [ 872.338571] binder_alloc: 717: binder_alloc_buf, no vma [ 872.368752] binder: 717:725 got reply transaction with no transaction stack [ 872.368811] binder: release 717:719 transaction 1497 out, still active 04:48:16 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) ioprio_get$pid(0x0, r2) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) [ 872.419827] binder: undelivered TRANSACTION_COMPLETE [ 872.444183] binder: send failed reply for transaction 1497, target dead 04:48:17 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:17 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) 04:48:17 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0xfffffffffffffffc, 0x0, @mcast2, 0x20000000002}, 0x1c) openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x1f5, 0x20007ffc) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) r2 = syz_open_dev$mouse(0x0, 0x81, 0x10040) connect$ax25(r2, &(0x7f0000000140)={{0x3, @bcast, 0x4}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @null, @null]}, 0x48) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000100), 0x2) 04:48:17 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x80000000000a01, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000240)) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000100)) 04:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 872.569649] binder_alloc: binder_alloc_mmap_handler: 733 20001000-20004000 already mapped failed -16 [ 872.614608] binder: BINDER_SET_CONTEXT_MGR already set 04:48:17 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) eventfd(0x0) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) munlockall() r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) syncfs(r0) [ 872.652183] binder: 733:737 ioctl 40046207 0 returned -16 [ 872.684513] binder_alloc: 733: binder_alloc_buf, no vma 04:48:17 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000002f00)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000180)=""/87, 0x57}], 0x1, &(0x7f0000000200)=""/18, 0x12}, 0x8}, {{&(0x7f0000000240)=@xdp, 0x80, &(0x7f0000000380)}, 0x1}, {{&(0x7f00000003c0)=@generic, 0x80, &(0x7f0000001640)=[{&(0x7f0000000440)=""/243, 0xf3}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/6, 0x6}, {&(0x7f0000001580)=""/189, 0xbd}], 0x4, &(0x7f0000001680)=""/132, 0x84}, 0xf6f}, {{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000001a80)=""/4096, 0x1000}], 0x1}}], 0x4, 0x100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/route\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) [ 872.735894] binder: 733:737 got reply transaction with no transaction stack [ 872.778225] binder: release 733:737 transaction 1502 out, still active [ 872.793949] binder: undelivered TRANSACTION_COMPLETE [ 872.836417] binder: send failed reply for transaction 1502, target dead 04:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:17 executing program 4: 04:48:17 executing program 1: [ 872.951709] binder: BINDER_SET_CONTEXT_MGR already set [ 872.966808] binder_alloc: 764: binder_alloc_buf, no vma [ 873.003083] binder: release 764:765 transaction 1507 out, still active [ 873.003407] binder: 764:765 ioctl 40046207 0 returned -16 [ 873.013626] binder: send failed reply for transaction 1507, target dead 04:48:17 executing program 4: [ 873.081833] device nr0 entered promiscuous mode 04:48:17 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) read$eventfd(r0, &(0x7f0000000000), 0x8) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000000200), 0x1c) 04:48:18 executing program 4: perf_event_open(&(0x7f0000000080)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x400, 0x9d8, 0x0, 0x0, 0x8, 0x93, 0xb09, 0xc9f4, 0x0, 0x8, 0x4f, 0x3, 0x6, 0x81, 0x8, 0xf, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffc00, 0xffffffffffffffc1, 0x10000, 0x5, 0x6, 0x0, 0x0, 0x5, @perf_bp={0x0}, 0x1, 0x0, 0x0, 0x7, 0xf09e, 0x0, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) r1 = openat$zero(0xffffffffffffff9c, 0x0, 0xa02, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x8) fcntl$notify(r0, 0x402, 0x20) r2 = syz_open_dev$mice(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x0, 0x3, @thr={&(0x7f0000000040), 0x0}}, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x40000080806, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000000100)) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x20000000) r4 = socket$inet6(0xa, 0x6, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000180)={0x7, 0x1, 0xee4, 0x0, 0x19, 0x5, 0x2, 0x6, 0x0, 0x0, 0x1ff, 0x12c}) connect$inet6(r4, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r5 = accept4(r3, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0) setsockopt$inet6_int(r5, 0x29, 0x33, &(0x7f0000000040)=0x100000000001f, 0x87) sendmmsg(r5, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) 04:48:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) r2 = dup(r1) close(r0) readv(r2, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/186, 0xba}], 0x1) 04:48:18 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:18 executing program 1: [ 873.550879] binder: BINDER_SET_CONTEXT_MGR already set 04:48:18 executing program 2: [ 873.619226] binder: 784:786 ioctl 40046207 0 returned -16 04:48:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:18 executing program 1: 04:48:18 executing program 2: 04:48:18 executing program 2: [ 873.823956] binder: BINDER_SET_CONTEXT_MGR already set [ 873.841357] binder: 803:805 ioctl 40046207 0 returned -16 [ 873.850223] device nr0 entered promiscuous mode 04:48:18 executing program 5: ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, 0x2, 0x5, 0x4, &(0x7f0000ffc000/0x2000)=nil, 0x252c}) r1 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r1, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r1, &(0x7f0000000200), 0x1000) 04:48:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:18 executing program 1: [ 874.285920] binder_transaction: 4 callbacks suppressed [ 874.285936] binder: 811:813 got reply transaction with bad transaction stack, transaction 1518 has target 811:0 [ 874.331907] binder_transaction: 20 callbacks suppressed [ 874.331927] binder: 811:813 transaction failed 29201/-71, size 0-0 line 2816 [ 874.357940] binder_alloc_mmap_handler: 3 callbacks suppressed [ 874.357958] binder_alloc: binder_alloc_mmap_handler: 811 20001000-20004000 already mapped failed -16 [ 874.374718] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 874.374726] binder_alloc: 811: binder_alloc_buf, no vma [ 874.378953] binder: BINDER_SET_CONTEXT_MGR already set [ 874.384676] binder: 811:817 transaction failed 29189/-3, size 0-0 line 3035 [ 874.392329] binder: 811:813 ioctl 40046207 0 returned -16 [ 874.399820] binder_thread_release: 2 callbacks suppressed [ 874.399831] binder: release 811:813 transaction 1518 out, still active [ 874.418993] binder_release_work: 3 callbacks suppressed [ 874.418998] binder: undelivered TRANSACTION_COMPLETE 04:48:18 executing program 4: 04:48:18 executing program 2: 04:48:18 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:18 executing program 1: 04:48:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 874.436073] binder_release_work: 18 callbacks suppressed [ 874.436368] binder: undelivered TRANSACTION_ERROR: 29201 04:48:19 executing program 1: 04:48:19 executing program 2: [ 874.477852] binder: undelivered TRANSACTION_ERROR: 29189 [ 874.501370] binder_send_failed_reply: 2 callbacks suppressed [ 874.501377] binder: send failed reply for transaction 1518, target dead [ 874.562621] binder: 827:830 got reply transaction with bad transaction stack, transaction 1522 has target 827:0 [ 874.620722] binder: 827:830 transaction failed 29201/-71, size 0-0 line 2816 04:48:19 executing program 2: 04:48:19 executing program 4: syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) symlink(&(0x7f0000000180)='./file1\x00', &(0x7f0000000440)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000140)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(r1, 0x800454cf, 0x0) [ 874.662927] binder_alloc: binder_alloc_mmap_handler: 827 20001000-20004000 already mapped failed -16 [ 874.705697] binder: BINDER_SET_CONTEXT_MGR already set [ 874.727362] binder: 827:830 ioctl 40046207 0 returned -16 [ 874.757774] binder_alloc: 827: binder_alloc_buf, no vma [ 874.768528] binder: 827:844 transaction failed 29189/-3, size 0-0 line 3035 [ 874.786461] binder: 827:830 got reply transaction with no transaction stack [ 874.798665] binder: release 827:830 transaction 1522 out, still active [ 874.809168] binder: 827:830 transaction failed 29201/-71, size 0-0 line 2801 [ 874.820977] binder: undelivered TRANSACTION_COMPLETE [ 874.822941] device nr0 entered promiscuous mode [ 874.845344] binder: undelivered TRANSACTION_ERROR: 29201 [ 874.868968] binder: undelivered TRANSACTION_ERROR: 29201 [ 874.888297] binder: undelivered TRANSACTION_ERROR: 29189 [ 874.904230] binder: send failed reply for transaction 1522, target dead 04:48:19 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$CAPI_SET_FLAGS(r0, 0x80044324, &(0x7f0000000040)=0x1) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)) read$FUSE(r0, &(0x7f0000000200), 0x1000) r3 = getpgrp(0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) rt_tgsigqueueinfo(r3, r4, 0x7, &(0x7f00000000c0)={0x30, 0x101, 0xfffffffffffffffb}) 04:48:19 executing program 1: 04:48:19 executing program 2: 04:48:19 executing program 4: 04:48:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:19 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x1, 0xfdef) 04:48:19 executing program 4: 04:48:19 executing program 2: 04:48:19 executing program 1: [ 875.242160] binder: 852:855 got reply transaction with bad transaction stack, transaction 1527 has target 852:0 [ 875.313059] binder: 852:855 transaction failed 29201/-71, size 0-0 line 2816 04:48:19 executing program 4: 04:48:19 executing program 2: 04:48:19 executing program 1: [ 875.374571] binder_alloc: binder_alloc_mmap_handler: 852 20001000-20004000 already mapped failed -16 [ 875.431368] binder: BINDER_SET_CONTEXT_MGR already set [ 875.480319] binder: 852:855 ioctl 40046207 0 returned -16 [ 875.482220] binder_alloc: 852: binder_alloc_buf, no vma [ 875.526153] binder: release 852:855 transaction 1527 out, still active [ 875.526266] binder: 852:876 transaction failed 29189/-3, size 0-0 line 3035 [ 875.535623] binder: undelivered TRANSACTION_COMPLETE [ 875.563160] device nr0 entered promiscuous mode [ 875.592189] binder: undelivered TRANSACTION_ERROR: 29201 [ 875.608685] binder: undelivered TRANSACTION_ERROR: 29189 [ 875.616055] binder: send failed reply for transaction 1527, target dead 04:48:20 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000040)={0x81, [0x8725, 0x6, 0x0, 0x2, 0x0, 0x7, 0x40, 0x3, 0x7fff, 0x4, 0x9, 0x401, 0x0, 0x8000, 0xfffffffffffffff7, 0x7ff, 0x0, 0xfffffffffffffc00, 0x1, 0x7f, 0x2, 0x100000000, 0x7, 0x8001, 0x50f, 0x0, 0x2, 0xfff, 0x4, 0xfff, 0x7, 0xf6c8, 0x45, 0xff, 0x3, 0x7, 0x0, 0x9, 0x9, 0x6, 0x4000000000000, 0x8001, 0x101, 0x10001, 0x1ff, 0x10000, 0x7fffffff, 0x2], 0xb}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:20 executing program 4: 04:48:20 executing program 1: 04:48:20 executing program 2: 04:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:20 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x1, 0xfdef) [ 876.099088] binder: 883:886 got reply transaction with bad transaction stack, transaction 1531 has target 883:0 04:48:20 executing program 2: 04:48:20 executing program 1: 04:48:20 executing program 4: [ 876.157625] binder: 883:886 transaction failed 29201/-71, size 0-0 line 2816 [ 876.208382] binder_alloc: binder_alloc_mmap_handler: 883 20001000-20004000 already mapped failed -16 04:48:20 executing program 4: 04:48:20 executing program 2: 04:48:20 executing program 1: [ 876.285049] binder_alloc: 883: binder_alloc_buf, no vma [ 876.304857] binder: BINDER_SET_CONTEXT_MGR already set [ 876.323679] binder: 883:896 transaction failed 29189/-3, size 0-0 line 3035 [ 876.331623] binder: 883:886 got reply transaction with no transaction stack [ 876.373630] binder: 883:899 ioctl 40046207 0 returned -16 [ 876.392588] binder: release 883:886 transaction 1531 out, still active [ 876.400881] binder: 883:886 transaction failed 29201/-71, size 0-0 line 2801 [ 876.409108] device nr0 entered promiscuous mode [ 876.412456] binder: undelivered TRANSACTION_COMPLETE [ 876.431017] binder: undelivered TRANSACTION_ERROR: 29201 [ 876.447094] binder: undelivered TRANSACTION_ERROR: 29201 [ 876.462723] binder: undelivered TRANSACTION_ERROR: 29189 [ 876.476799] binder: send failed reply for transaction 1531, target dead 04:48:21 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000040)=0x0) r4 = geteuid() fstat(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={r3, r4, r5}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f00000013c0), 0xfffffffffffffeee) 04:48:21 executing program 4: 04:48:21 executing program 2: 04:48:21 executing program 1: 04:48:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:21 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x1, 0xfdef) 04:48:21 executing program 4: 04:48:21 executing program 1: 04:48:21 executing program 2: [ 876.990522] binder: 910:914 got reply transaction with bad transaction stack, transaction 1536 has target 910:0 [ 877.051631] binder_alloc: binder_alloc_mmap_handler: 910 20001000-20004000 already mapped failed -16 [ 877.096997] binder: BINDER_SET_CONTEXT_MGR already set 04:48:21 executing program 4: [ 877.124480] binder: 910:914 ioctl 40046207 0 returned -16 04:48:21 executing program 2: 04:48:21 executing program 1: [ 877.170956] binder_alloc: 910: binder_alloc_buf, no vma [ 877.191792] binder: 910:914 got reply transaction with no transaction stack [ 877.238394] binder: release 910:914 transaction 1536 out, still active [ 877.250180] binder: undelivered TRANSACTION_COMPLETE [ 877.277650] binder: send failed reply for transaction 1536, target dead [ 877.312191] device nr0 entered promiscuous mode 04:48:22 executing program 2: 04:48:22 executing program 4: 04:48:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:22 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000001200)={@in={{0x2, 0x4e22, @rand_addr=0x8001}}, 0x0, 0x10000, 0x0, "99350c9994792961cc1af946bfc15a056e4e4bef151dda6d8bd687dc608bbb81aa53f28cc75d9893734709c939fd68cc402ad15867c75463f2f410a5afc2696f6cf1357a2fb301cadcee4ad02efa3433"}, 0xd8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f0000000040)={0xffffffffffffffc0, 0x80000001, 0x10000}) 04:48:22 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:22 executing program 1: [ 877.615753] binder: 939:940 got reply transaction with bad transaction stack, transaction 1541 has target 939:0 04:48:22 executing program 4: 04:48:22 executing program 1: 04:48:22 executing program 2: [ 877.689953] binder_alloc: binder_alloc_mmap_handler: 939 20001000-20004000 already mapped failed -16 [ 877.709277] binder: BINDER_SET_CONTEXT_MGR already set [ 877.722540] binder_alloc: 939: binder_alloc_buf, no vma [ 877.782620] binder: release 939:940 transaction 1541 out, still active [ 877.789853] binder: 939:940 ioctl 40046207 0 returned -16 [ 877.806397] binder: undelivered TRANSACTION_COMPLETE 04:48:22 executing program 4: 04:48:22 executing program 1: [ 877.838412] binder: send failed reply for transaction 1541, target dead 04:48:22 executing program 2: 04:48:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:22 executing program 2: 04:48:22 executing program 4: [ 877.993189] binder: 968:969 got reply transaction with bad transaction stack, transaction 1545 has target 968:0 [ 878.032977] binder_alloc: binder_alloc_mmap_handler: 968 20001000-20004000 already mapped failed -16 [ 878.059989] device nr0 entered promiscuous mode [ 878.074628] binder: BINDER_SET_CONTEXT_MGR already set [ 878.088667] binder: 968:969 ioctl 40046207 0 returned -16 [ 878.102734] binder_alloc: 968: binder_alloc_buf, no vma [ 878.108623] binder: release 968:969 transaction 1545 out, still active [ 878.117346] binder: undelivered TRANSACTION_COMPLETE [ 878.129780] binder: send failed reply for transaction 1545, target dead 04:48:23 executing program 4: 04:48:23 executing program 1: 04:48:23 executing program 2: 04:48:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:23 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x20000000006) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{0x3, 0x5, 0x6, 0x5e75ba40}, {0x5, 0xc418, 0x6, 0x3}, {0x681, 0x7b, 0xfffffffffffffff8, 0x2}]}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f00000000c0)=0x8f0f, 0x4) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:23 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(r4, &(0x7f0000000000)=0x1, 0xfdef) 04:48:23 executing program 2: [ 878.592347] binder: 980:983 got reply transaction with bad transaction stack, transaction 1549 has target 980:0 04:48:23 executing program 1: ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f00000002c0)={'veth0_to_bridge\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) r0 = inotify_init1(0x80802) setxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000240)='system_u:object_r:audisp_exec_t:s0\x00', 0x23, 0x0) rt_sigtimedwait(&(0x7f0000000300)={0x4}, &(0x7f00000003c0), 0x0, 0x8) getpid() fcntl$setown(r0, 0x8, 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(0xffffffffffffffff, 0x40189206, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000380)={0x1200, 0x4004400}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000bc2000/0x3000)=nil, &(0x7f00000000c0)) mmap(&(0x7f0000919000/0x400000)=nil, 0x400000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440), 0xc, 0x0}, 0x0) 04:48:23 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000000)='./control\x00', 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f00000000c0)='./control\x00', 0x220001a2) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) creat(&(0x7f0000000100)='./control/file0\x00', 0x0) [ 878.680846] binder_alloc: binder_alloc_mmap_handler: 980 20001000-20004000 already mapped failed -16 [ 878.726684] binder: BINDER_SET_CONTEXT_MGR already set [ 878.751625] binder: 980:983 ioctl 40046207 0 returned -16 [ 878.790523] binder_alloc: 980: binder_alloc_buf, no vma 04:48:23 executing program 2: r0 = open(&(0x7f0000000140)='.\x00', 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0xfffffffffffffe5b) r1 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x6685) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) read(r0, 0x0, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x2, 0x0, 0x4c6) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) tkill(r1, 0x1000000000016) [ 878.807971] binder: 980:983 got reply transaction with no transaction stack [ 878.830749] binder: release 980:983 transaction 1549 out, still active [ 878.841662] binder: undelivered TRANSACTION_COMPLETE 04:48:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 878.866167] binder: send failed reply for transaction 1549, target dead 04:48:23 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10000006, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$xdp(0x2c, 0x3, 0x0) io_setup(0x0, &(0x7f00000008c0)=0x0) io_cancel(r2, 0x0, 0x0) accept$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000680)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@broadcast, @in=@multicast1, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x80, 0xa0, 0xbf}, {0x0, 0x2, 0xffff, 0x0, 0x0, 0x100000001, 0xffff}, {0xfffffffffffffffe, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x726b313db152e4aa, 0x1}, {{@in6=@mcast2, 0x4d6, 0x33}, 0xa, @in=@dev, 0x3501, 0x0, 0x0, 0xfff, 0x7, 0x8}}, 0xe8) syz_open_dev$sndseq(&(0x7f0000000580)='/dev/snd/seq\x00', 0x0, 0x10000000000100) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@local, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000880)=0xe8) connect(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000280)="d1ff4b4a32419c0b624d07e66e060aa435178fad4ce9436c5be3facc2f5ad8fa7115704436f9246d3fcc6a37", 0x2c, 0x80, 0x0, 0x0) read$eventfd(r1, &(0x7f00000007c0), 0x8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) setpgid(0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000200)=0x8) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x200096dc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000729002d0000000000000000000100ff718412b4961e0f720000"], 0x1}}, 0x0) connect(r0, &(0x7f0000000800)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4, 0x0, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0x8}}}, 0x80) [ 878.978352] binder: 1005:1006 got reply transaction with bad transaction stack, transaction 1554 has target 1005:0 [ 879.040821] binder_alloc: binder_alloc_mmap_handler: 1005 20001000-20004000 already mapped failed -16 [ 879.057706] binder: BINDER_SET_CONTEXT_MGR already set [ 879.076261] binder: 1005:1009 ioctl 40046207 0 returned -16 [ 879.092045] binder_alloc: 1005: binder_alloc_buf, no vma [ 879.102273] binder: 1005:1006 got reply transaction with no transaction stack [ 879.108267] binder: release 1005:1006 transaction 1554 out, still active 04:48:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 879.168205] binder: undelivered TRANSACTION_COMPLETE [ 879.200393] binder: send failed reply for transaction 1554, target dead [ 879.249568] device nr0 entered promiscuous mode [ 879.282239] binder: 1013:1014 got reply transaction with bad transaction stack, transaction 1559 has target 1013:0 04:48:23 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x1, 0xfdef) [ 879.330957] binder_alloc: binder_alloc_mmap_handler: 1013 20001000-20004000 already mapped failed -16 [ 879.378395] binder: BINDER_SET_CONTEXT_MGR already set [ 879.422691] binder: 1013:1014 ioctl 40046207 0 returned -16 [ 879.436812] binder_alloc: 1013: binder_alloc_buf, no vma [ 879.468762] binder_transaction: 14 callbacks suppressed [ 879.468781] binder: 1013:1018 transaction failed 29189/-3, size 0-0 line 3035 [ 879.487171] binder: release 1013:1014 transaction 1559 out, still active [ 879.487270] binder: 1013:1014 got reply transaction with no transaction stack [ 879.500200] binder: undelivered TRANSACTION_COMPLETE [ 879.511789] binder_release_work: 13 callbacks suppressed 04:48:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10000006, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$xdp(0x2c, 0x3, 0x0) io_setup(0x0, &(0x7f00000008c0)=0x0) io_cancel(r2, 0x0, 0x0) accept$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000680)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@broadcast, @in=@multicast1, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x80, 0xa0, 0xbf}, {0x0, 0x2, 0xffff, 0x0, 0x0, 0x100000001, 0xffff}, {0xfffffffffffffffe, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x726b313db152e4aa, 0x1}, {{@in6=@mcast2, 0x4d6, 0x33}, 0xa, @in=@dev, 0x3501, 0x0, 0x0, 0xfff, 0x7, 0x8}}, 0xe8) syz_open_dev$sndseq(&(0x7f0000000580)='/dev/snd/seq\x00', 0x0, 0x10000000000100) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@local, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000880)=0xe8) connect(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000280)="d1ff4b4a32419c0b624d07e66e060aa435178fad4ce9436c5be3facc2f5ad8fa7115704436f9246d3fcc6a37", 0x2c, 0x80, 0x0, 0x0) read$eventfd(r1, &(0x7f00000007c0), 0x8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) setpgid(0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000200)=0x8) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x200096dc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000729002d0000000000000000000100ff718412b4961e0f720000"], 0x1}}, 0x0) connect(r0, &(0x7f0000000800)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4, 0x0, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0x8}}}, 0x80) [ 879.511795] binder: undelivered TRANSACTION_ERROR: 29201 [ 879.533424] binder: 1013:1014 transaction failed 29201/-71, size 0-0 line 2801 [ 879.538459] binder: send failed reply for transaction 1559, target dead 04:48:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 879.580194] binder: undelivered TRANSACTION_ERROR: 29201 [ 879.605480] binder: undelivered TRANSACTION_ERROR: 29189 04:48:24 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f00000023c0), 0x1000) set_thread_area(&(0x7f0000000040)={0x8, 0x20001800, 0xffffffffffffffff, 0x1, 0x6, 0x800, 0x4, 0x800, 0x6}) [ 879.708544] binder: 1029:1030 got reply transaction with bad transaction stack, transaction 1564 has target 1029:0 [ 879.781764] binder: 1029:1030 transaction failed 29201/-71, size 0-0 line 2816 [ 879.835159] binder_alloc: binder_alloc_mmap_handler: 1029 20001000-20004000 already mapped failed -16 [ 879.902326] binder: BINDER_SET_CONTEXT_MGR already set [ 879.930358] binder: 1029:1030 ioctl 40046207 0 returned -16 [ 879.959146] binder_alloc: 1029: binder_alloc_buf, no vma [ 879.998709] binder: 1029:1054 transaction failed 29189/-3, size 0-0 line 3035 [ 880.004437] binder: send failed reply for transaction 1564 to 1029:1030 [ 880.023456] binder: undelivered TRANSACTION_COMPLETE [ 880.045099] binder: undelivered TRANSACTION_ERROR: 29201 [ 880.067356] binder: undelivered TRANSACTION_ERROR: 29189 [ 880.080963] binder: undelivered TRANSACTION_ERROR: 29189 04:48:24 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(r4, &(0x7f0000000000)=0x1, 0xfdef) 04:48:24 executing program 1: ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f00000002c0)={'veth0_to_bridge\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) r0 = inotify_init1(0x80802) setxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000240)='system_u:object_r:audisp_exec_t:s0\x00', 0x23, 0x0) rt_sigtimedwait(&(0x7f0000000300)={0x4}, &(0x7f00000003c0), 0x0, 0x8) getpid() fcntl$setown(r0, 0x8, 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(0xffffffffffffffff, 0x40189206, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000380)={0x1200, 0x4004400}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000bc2000/0x3000)=nil, &(0x7f00000000c0)) mmap(&(0x7f0000919000/0x400000)=nil, 0x400000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440), 0xc, 0x0}, 0x0) 04:48:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10000006, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$xdp(0x2c, 0x3, 0x0) io_setup(0x0, &(0x7f00000008c0)=0x0) io_cancel(r2, 0x0, 0x0) accept$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000680)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@broadcast, @in=@multicast1, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x80, 0xa0, 0xbf}, {0x0, 0x2, 0xffff, 0x0, 0x0, 0x100000001, 0xffff}, {0xfffffffffffffffe, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x726b313db152e4aa, 0x1}, {{@in6=@mcast2, 0x4d6, 0x33}, 0xa, @in=@dev, 0x3501, 0x0, 0x0, 0xfff, 0x7, 0x8}}, 0xe8) syz_open_dev$sndseq(&(0x7f0000000580)='/dev/snd/seq\x00', 0x0, 0x10000000000100) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@local, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000880)=0xe8) connect(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000280)="d1ff4b4a32419c0b624d07e66e060aa435178fad4ce9436c5be3facc2f5ad8fa7115704436f9246d3fcc6a37", 0x2c, 0x80, 0x0, 0x0) read$eventfd(r1, &(0x7f00000007c0), 0x8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) setpgid(0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000200)=0x8) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x200096dc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000729002d0000000000000000000100ff718412b4961e0f720000"], 0x1}}, 0x0) connect(r0, &(0x7f0000000800)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4, 0x0, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0x8}}}, 0x80) [ 880.175810] device nr0 entered promiscuous mode 04:48:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 880.247584] binder: 1056:1061 got reply transaction with bad transaction stack, transaction 1568 has target 1056:0 [ 880.283005] binder: 1056:1061 transaction failed 29201/-71, size 0-0 line 2816 [ 880.328288] binder_alloc: binder_alloc_mmap_handler: 1056 20001000-20004000 already mapped failed -16 [ 880.373495] binder: BINDER_SET_CONTEXT_MGR already set [ 880.403783] binder: 1056:1061 ioctl 40046207 0 returned -16 [ 880.434560] binder_alloc: 1056: binder_alloc_buf, no vma [ 880.483515] binder: 1056:1061 got reply transaction with no transaction stack [ 880.534598] binder: release 1056:1061 transaction 1568 out, still active [ 880.541962] binder: 1056:1073 transaction failed 29189/-3, size 0-0 line 3035 [ 880.551799] binder: undelivered TRANSACTION_COMPLETE [ 880.579829] binder: undelivered TRANSACTION_ERROR: 29201 [ 880.596615] binder: 1056:1061 transaction failed 29201/-71, size 0-0 line 2801 [ 880.614172] binder: send failed reply for transaction 1568, target dead 04:48:25 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x40400203) read$FUSE(r0, &(0x7f0000000200), 0x1000) socket$kcm(0x29, 0x2, 0x0) 04:48:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 880.663046] binder: undelivered TRANSACTION_ERROR: 29201 [ 880.696051] binder: undelivered TRANSACTION_ERROR: 29189 04:48:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10000006, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$xdp(0x2c, 0x3, 0x0) io_setup(0x0, &(0x7f00000008c0)=0x0) io_cancel(r2, 0x0, 0x0) accept$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000600)=0x14) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000680)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@broadcast, @in=@multicast1, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x80, 0xa0, 0xbf}, {0x0, 0x2, 0xffff, 0x0, 0x0, 0x100000001, 0xffff}, {0xfffffffffffffffe, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x726b313db152e4aa, 0x1}, {{@in6=@mcast2, 0x4d6, 0x33}, 0xa, @in=@dev, 0x3501, 0x0, 0x0, 0xfff, 0x7, 0x8}}, 0xe8) syz_open_dev$sndseq(&(0x7f0000000580)='/dev/snd/seq\x00', 0x0, 0x10000000000100) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@local, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000880)=0xe8) connect(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000280)="d1ff4b4a32419c0b624d07e66e060aa435178fad4ce9436c5be3facc2f5ad8fa7115704436f9246d3fcc6a37", 0x2c, 0x80, 0x0, 0x0) read$eventfd(r1, &(0x7f00000007c0), 0x8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) setpgid(0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000200)=0x8) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x200096dc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000729002d0000000000000000000100ff718412b4961e0f720000"], 0x1}}, 0x0) connect(r0, &(0x7f0000000800)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4, 0x0, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0x8}}}, 0x80) [ 880.799796] binder: 1079:1080 got reply transaction with bad transaction stack, transaction 1573 has target 1079:0 [ 880.830782] binder: 1079:1080 transaction failed 29201/-71, size 0-0 line 2816 [ 880.867154] binder_alloc: binder_alloc_mmap_handler: 1079 20001000-20004000 already mapped failed -16 [ 880.923312] binder: BINDER_SET_CONTEXT_MGR already set [ 880.956832] binder: 1079:1080 ioctl 40046207 0 returned -16 [ 880.958879] binder_alloc: 1079: binder_alloc_buf, no vma [ 880.982729] binder: 1079:1087 transaction failed 29189/-3, size 0-0 line 3035 [ 881.004848] binder: 1079:1080 got reply transaction with no transaction stack [ 881.012205] binder: 1079:1080 transaction failed 29201/-71, size 0-0 line 2801 [ 881.053798] binder: undelivered TRANSACTION_ERROR: 29201 [ 881.079081] binder: send failed reply for transaction 1573 to 1079:1080 04:48:25 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(r4, &(0x7f0000000000)=0x1, 0xfdef) [ 881.126442] binder: undelivered TRANSACTION_COMPLETE 04:48:25 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:25 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x200000007) write$cgroup_int(r4, &(0x7f0000000000)=0x1, 0xfdef) 04:48:25 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 881.330624] binder: 1095:1097 got reply transaction with bad transaction stack, transaction 1578 has target 1095:0 [ 881.358778] binder_alloc: binder_alloc_mmap_handler: 1095 20001000-20004000 already mapped failed -16 [ 881.381642] binder: BINDER_SET_CONTEXT_MGR already set [ 881.399101] binder: 1095:1097 ioctl 40046207 0 returned -16 [ 881.409328] binder_alloc: 1095: binder_alloc_buf, no vma 04:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 881.426960] binder: release 1095:1097 transaction 1578 out, still active [ 881.440472] binder: undelivered TRANSACTION_COMPLETE [ 881.468957] binder: send failed reply for transaction 1578, target dead [ 881.607146] binder: 1115:1118 got reply transaction with bad transaction stack, transaction 1582 has target 1115:0 [ 881.635568] binder_alloc: binder_alloc_mmap_handler: 1115 20001000-20004000 already mapped failed -16 [ 881.656042] binder: BINDER_SET_CONTEXT_MGR already set [ 881.661617] binder: 1115:1118 ioctl 40046207 0 returned -16 [ 881.671554] binder_alloc: 1115: binder_alloc_buf, no vma [ 881.677596] binder: release 1115:1118 transaction 1582 out, still active [ 881.694263] binder: undelivered TRANSACTION_COMPLETE 04:48:26 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)) pipe(&(0x7f0000000040)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 881.714171] binder: send failed reply for transaction 1582, target dead [ 881.801998] binder: 1128:1129 got reply transaction with bad transaction stack, transaction 1586 has target 1128:0 [ 881.809827] device nr0 entered promiscuous mode [ 881.815837] binder_alloc: binder_alloc_mmap_handler: 1128 20001000-20004000 already mapped failed -16 [ 881.828960] binder: BINDER_SET_CONTEXT_MGR already set [ 881.835199] binder: 1128:1129 ioctl 40046207 0 returned -16 [ 881.835297] binder_alloc: 1128: binder_alloc_buf, no vma [ 881.835536] binder: release 1128:1129 transaction 1586 out, still active 04:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 881.889564] binder: undelivered TRANSACTION_COMPLETE [ 881.900691] binder: send failed reply for transaction 1586, target dead [ 881.919442] device nr0 entered promiscuous mode 04:48:26 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 881.961392] binder: 1133:1134 got reply transaction with bad transaction stack, transaction 1590 has target 1133:0 [ 881.985207] binder_alloc: binder_alloc_mmap_handler: 1133 20001000-20004000 already mapped failed -16 04:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 882.029964] binder_alloc: 1133: binder_alloc_buf, no vma [ 882.032552] binder: BINDER_SET_CONTEXT_MGR already set [ 882.046404] binder: 1133:1134 ioctl 40046207 0 returned -16 [ 882.052293] binder: release 1133:1134 transaction 1590 out, still active [ 882.060643] binder: undelivered TRANSACTION_COMPLETE [ 882.070451] binder: send failed reply for transaction 1590, target dead [ 882.153641] binder: 1141:1142 got reply transaction with bad transaction stack, transaction 1594 has target 1141:0 [ 882.183986] binder_alloc: binder_alloc_mmap_handler: 1141 20001000-20004000 already mapped failed -16 [ 882.202218] binder: BINDER_SET_CONTEXT_MGR already set [ 882.209801] binder: 1141:1143 ioctl 40046207 0 returned -16 [ 882.231807] binder_alloc: 1141: binder_alloc_buf, no vma [ 882.239252] binder: 1141:1142 got reply transaction with no transaction stack [ 882.246742] binder: release 1141:1142 transaction 1594 out, still active 04:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 882.262853] binder: undelivered TRANSACTION_COMPLETE [ 882.268146] binder: send failed reply for transaction 1594, target dead [ 882.316272] binder: 1145:1146 got reply transaction with bad transaction stack, transaction 1599 has target 1145:0 [ 882.330735] binder_alloc: binder_alloc_mmap_handler: 1145 20001000-20004000 already mapped failed -16 [ 882.355992] binder: BINDER_SET_CONTEXT_MGR already set [ 882.364815] binder: 1145:1146 ioctl 40046207 0 returned -16 [ 882.376429] binder_alloc: 1145: binder_alloc_buf, no vma [ 882.390268] binder: release 1145:1146 transaction 1599 out, still active [ 882.401993] binder: undelivered TRANSACTION_COMPLETE [ 882.417852] binder: send failed reply for transaction 1599, target dead 04:48:27 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r8, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:27 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimensat(r4, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={{0x77359400}, {r6, r7/1000+10000}}, 0x100) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) ioctl$TUNSETVNETBE(r1, 0x400454de, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 882.616422] binder: 1152:1156 got reply transaction with bad transaction stack, transaction 1603 has target 1152:0 04:48:27 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) getresgid(&(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x9, 0x2000000000000000}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x8, @local, 0xa17}}, 0x7, 0x80000001}, &(0x7f0000000380)=0x90) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000ac0)={0x0, 0x1}, &(0x7f0000000b00)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000b40)={0x0, @in={{0x2, 0x4e21, @local}}, 0x1, 0x73c, 0x2, 0x10000, 0xc1}, &(0x7f0000000c00)=0x98) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000c40)={0x0, 0x0, 0xf07, 0x1, 0x1, 0x7}, &(0x7f0000000c80)=0x14) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000cc0)={0x0, @in6={{0xa, 0x4e24, 0x4, @remote, 0x6}}, 0xfff, 0x7fff, 0x9, 0xfffffffffffffff8, 0x1}, &(0x7f0000000d80)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000003000)={0x0, 0x400, 0x7ff}, &(0x7f0000003040)=0x8) sendmmsg$inet_sctp(r0, &(0x7f0000003140)=[{&(0x7f0000000040)=@in={0x2, 0x4e22, @broadcast}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000080)="6ec98e56aff9e5df726b37e3413d97c53edee55c1400927a279d48e73de98cd817b8604cca47ce2cfd60cb2df8931039db78bed95c4dc02f9068b40887e55e6edf51c4d60caced5e5361e734148767586b284598fcfc8c22d2af4be8212b16e8367fb6dd8d2361a9db3c67a585994b06b926db6bc9fb7d355b43dd8b6a408798505bb1aca0d46d59c9eb611218d2fd9509be7583684b53aa744c3887a033108266888fe528c27c78a621bcd5e7675a", 0xaf}, {&(0x7f0000000180)="f85b82bc1f71a425d8fcb516cd42f69d4567c816ff1e10440b9f92a6b45fb1b64f2bf91ec6593f78b688e589a85076b85344e6816e05f7291794d5a6e325f02cfadcaf2cf3a77b467aa07a45ed9b018d315592207d0f0593be07a243a585f78c679e037927bf3687ee", 0x69}], 0x2, &(0x7f0000000540)=[@prinfo={0x18, 0x84, 0x5, {0x20, 0x96}}, @sndrcv={0x30, 0x84, 0x1, {0x8, 0x7, 0x1, 0x2, 0x9, 0x3efe, 0xfffffffffffffffc, 0x1, r2}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x7}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x2}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast2}, @sndinfo={0x20, 0x84, 0x2, {0x6, 0x202, 0x4, 0x1467, r3}}], 0xc8, 0x11}, {&(0x7f00000003c0)=@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000400)="4f9859544936b9d1fcb036c0a69b06f083bb7891302a2762ad6378b4d0bfaba65ed3df91e52abf01ee335be2f42c52e8891de1d7e238bf2a73ae5a6af7fc753b11414fd83bf54be760408ed04e5f083e71d0e330657cd8bdd5af6cf55c30b0ee73315b32fc28aedee91af5908cea", 0x6e}], 0x1, &(0x7f0000000680)=[@dstaddrv6={0x20, 0x84, 0x8, @mcast2}], 0x20, 0x800}, {&(0x7f00000006c0)=@in={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000700)}, {&(0x7f0000000740)="6eee363a81193be92a6545ab58d6fe3cda4e76a90eba33aec14df7cd0f233475d6deb4fa3b28d5e23c", 0x29}, {&(0x7f0000000780)="3ce583bd5de4de7c534126ab446208070446c89d1af6029342fabeff12961688", 0x20}], 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000840000000500000030000000f263db91a2e810353225dce3f6c3000000"], 0x18, 0x4}, {&(0x7f0000000840)=@in={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000880)}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="cbfbe6f625371230ce17e617a25c4abeec6adaff2dcb9584004000060000000800000000000000"], 0x18, 0x10}, {&(0x7f0000000940)=@in6={0xa, 0x4e20, 0x3, @ipv4={[], [], @multicast2}, 0x3ff}, 0x1c, &(0x7f0000000a80)=[{&(0x7f0000000980)="000fca0845d31ec91a2e627d4583b6bd267518bc75527f3a931bff893bf11beed752d1280e0b2046286e59d79b8e50f17e307009900588a1a3eec0dfd6db5a7d10ae64b9d55c22570c601b66d8d77877c82824d7b6f61dbe3f4d6fed0fc3324c297d947369ce06ff7130b3c3ec3f7ca4c8e3bd3f480f78e5cc9d20ef1743b0fa97d80d3e3f56b024289ba951010615e61fbabb73fee55ecbc18a3d7532e05bb8f559e469b32252dce36dd5c7ab6a98ec781f0f16993772172590cb9651a49f16d277402c1b78188b63d9bd572a32b139a7158473c81eae99f92bad0af992e5505a779b78fe9513ba5f091a9c8e", 0xed}], 0x1, &(0x7f0000000dc0)=[@sndinfo={0x20, 0x84, 0x2, {0x0, 0x5, 0x7, 0xffffffffffffffc0, r4}}, @authinfo={0x18, 0x84, 0x6, {0x101}}, @authinfo={0x18, 0x84, 0x6, {0x8}}, @sndrcv={0x30, 0x84, 0x1, {0x4, 0x6, 0x8208, 0x7, 0x0, 0x101, 0xe7, 0x8, r5}}, @sndrcv={0x30, 0x84, 0x1, {0x4, 0x1f, 0x200, 0x40, 0x2b, 0x2, 0x3, 0x3, r6}}, @sndinfo={0x20, 0x84, 0x2, {0x20, 0x0, 0x100000000, 0x5, r7}}, @dstaddrv6={0x20, 0x84, 0x8, @loopback}], 0xf0, 0x4000}, {&(0x7f0000000ec0)=@in6={0xa, 0x4e20, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x81}, 0x1c, &(0x7f00000010c0)=[{&(0x7f0000000f00)="688363c7881444136c21be4425de5625f30591aac657b08c6f36fb60e8797eaf7a27ad9173d1d239e4b68ba752a541dfe1d24549c53afafea7f2eb955a0d90ec1ab4f8fc31b4519739126fe41e44de79fbcf371c265cd656f293c12d03a4dcfc75f8edeae18ba721491067891e9abe460d2cb39d37a689ea4b67aec944871e3906ccefd3265755ca001d4a213e0d54f1a5127661eb050e854d5be7e37628bb3a2176a06af1f11ecccf080eb9abb90686ed6dc2f2210f9c472fbba73b6c178d3c7ea5ae295a82337386ef03ea7b", 0xcd}, {&(0x7f0000001000)="388fc802b94c244a68b44e6178426edd763e1ec56f869221a17ab4cacae14cc0bf88523fac95a56353b2d7dad28bb760fe2d9b98192dc197c1e4a4c5df25241cee5af0f2c7be7a5ec206bc1ec5a50f175c9bbf4f6cbbcda945b5f954d13cc46726d3c2a31df05c0c8932c8d40fe214853044bf1c9f4b9088bf5d6af14887f255f7dd2fd9a4fbebf126cb381a1c8f4be4fbdb8d48f994", 0x96}], 0x2, 0x0, 0x0, 0x4}, {&(0x7f0000001100)=@in6={0xa, 0x4e20, 0x7, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4}, 0x1c, &(0x7f0000002580)=[{&(0x7f0000001140)="ea20cbe0af530191f4131f35eec44b245bb9245e8b137a5d7ffeda1fa095e65ff7b3e9fa26ebffe67f741bf67ceee6e93a99b4bf7a09bcf730ffad055b92c6453b411928789148958cbc6fac9d8321873ff9fbbca232358c3c8eb98f755696a2d975169c7cc4c325bc12fedd8ad9a51cb13cf0f517c429cd41afb9a1e77c9cb95642fe771de5", 0x86}, {&(0x7f0000001200)="84941a9c8c0ae1c94bd8d748e06db0e7219ef89bcad46627d45af1e2a61f9d977ec3e0c24d326375e20eadacf243c90659b26c89afda4968c5a5aa65192dcfefbf0e83eda21c88cd843bc9545ad95aa5b8eee80f5812e40f5ef873b43fe98c8554a0aa2171271f50e66fa5aadc06e180", 0x70}, {&(0x7f00000013c0)="d519801d972c781bc26d8c7ecf8f198713ae46511b452d5ccdca07f98e26c770cd27d6bb0879fd03d886e2b27aa65bb0759328a78dfa58c6f69be3ecd16100c317c6fe4d725933720688366f9568a636efa6fa740e80c937627e5d3868b214c5769da16ba87e074fae4845abed2893c715c3b27e864f9ed2d79e3a6390ae041caa5ae2b3d65cf5f77c0532ecc062bf56e9173743f5c3598bb39c8a9c42ca07c78e237c0dcc4544906e817036b2a16ec343037e23c7a016c9cf58e53e630705550163c8e62e40c35a6e6b7b9509b2ef57d0dc62b2243b515c0a6346c86708ecd01aae86c04eadaa5fe642b4ca4c6c766847d25fcf03d503078b11daa9dcf10f6d53662720732223330dd1afc8859d1378495e4b48f1a70f8da0f3b24c9a6edaa90fd30bb04363cc20b2c4a737d33222b262f4f20ed5250949e7d36270fb743b5da29984279db4f5b9a42a8a92363bfd358da9b6d8204c3cc02c400e004e227dac89552ce595da60798b6310524b88e80289c2c1fc24cddd936329a5c4aac847345dfb23a9317049c4bdd685bad8aba4800a90431c4c8a1c700038fc62ec6d671ae9af5c72850fecd21dfc311759b177a54aafaabc06c702e7c3a30dacc46c31e41adaa65898dd3c938e927da15061e58f2ea78079221e36da1f9739bc45c254d7d36c95b9f422b26f42f97cb74dfb23895d2590500b2785f34054f39cebeb6511331b3886a35ec7e5aeabaf7227a0d1d2bb85ca9d0281cfcf26519bb622370a9c2723a7b40e975174a6cdc3a20ca9f1c74b2c5cd8357f2d217b8c1f4defc11b310b75d9026ccd99be88d160e7c59b1e5ccfc9b8d40d0c5aa096aa0c0ab55178d24f0dc74e049868ff2eb9bedd8f67a9915ad0a7482ac3362e43935d9f7912f9b62a607dca7622d0b51945dc1f6b0578bdc785a3b0a48a364060a1c3561cd86fbc4608deb67580fd23f937a891ca92a356c0e3246bf34f464e517a349ac96d76ed42eb1b533b0e17b12f084ffad4573446a7cc582ca737b01431c8f50d4f547d8fe9105b56d61815b2e05184fa1e04183dee0bb08b7c4ead660bcc96bf8255c2b1acda325c9550b7f374b08aa53d5aaea814b23eff27ba27963e93e9137a2cf5d336836cf8ddc6dc3d3ba1e7a469118fda798ad6cbf05ff45cd8ed962aaaf87a0c76d2ecaa86e0df146330566bb9652a62036a45ddd770d524d0637a3dd8d40972c3f7ea2bf731406871467391a7c9c9c1319b56b9f5132509f3e006594c6911b9646680ebabf7e4e9f2ebca30d19cc55baa1d6f53ef7f6cb7897cb6d793a6631b574cac40659a44da6bea34f991190dfc66fde1fe03b24029630737f6b4483f2dacedc9b94553c8d2b162cd8022b27000b004e8402018a17adad4cdf9c21c8b9142cb768a9cf1fb6eeab683ceb9f4d588202d2da8e1f38916ebdcb47167861e01ec4b7e369a6821cb623de3f071f9fa0d615796392498377b97815d4f126e3ec882ba0ad7dd634eb529bb3439745fbc247bb7fd8f1714a1fcd5755d2c66bde963470e43cbeea2cf365655a5e326cd82d7310623f8d20bd3206857cc42571e775e7e3bf1e83b9e5683cf7fd6a2ddaaa7c4f88d94edadc70066b90cfc95c9b266f1e5d84f65504787ccd7b68312033d315de5c03eb56ad9185f751238b9f2edcdd1d1841fdc21893ef489e9637c72b20232e50f21ba4cc03ada8577f5ea4a09ec5c0a2d4be5976bb26fe322e5c65e5dd99afd5435f37d7c810c650f0146931b689b602ece5e63f0cdbbc0b6f438ff3bda5317e67b1a14d2315c0fad0da0a628b01c91ffe3a328de16834d936e7f030bdddfe510b67185e0b6724597d8ad5de8e73cf97daad1473c496683e77b32a647b5e695dbe7b20e8d78807e1ec9848ef2efa635d60ed3a82dc6814d5a6f7c307ffad76ef79abf199c08db03ec142838e97f2fb16463b94889fe47d0f3fd0a9c05c78b10bd3b18a362349416b89350cfd37edd48648572b38a053c08a0b166a7598cdf7bbba43fc544a460ba6de12d0b7d4aa82fd26bc4954aed7c8fcb7ef11f1d50d13b1661f64cf6ad0e5703273c517b24c62acf3b18eb8c28ac21f8099db314cb1df761e641f9bc75a54fea7c31306f163d007e40e1ea616574f7303fd3e2587713b8cf81bedecfa85637778e88df625631a0c426e0b458ad9c4743a79eb9b324161972fee75569087a8b858a22c743398acdaecafcc44eb368d41217fa5fcee89841e2bdcae9e9b6243b50e03d4e32d8f7b20b6584a30afb623702ed8279637b10d4627eefc73243b25e02cbd7034f81e622ec2e34283a676b18e7dd852232f7e186489d87517f0596c82e420f79dbce4a461a95187cf2185e504bf208b08bf7f99546f49c865587dbb166cd172390bdd3eebe8692e2947bfbb55f5007fb8d557bae53ca3dd0686a55d35c0dd510967bce0d2dff9c95a37a7d8e2ea605e6f8401c53bebde9e0ecf3e2b91e8ed34f1905b0f647c6368981884c5bd3fc7f6f62ccfcfe3e34aabb03c0da8630ea32c0b02a4897d8aba3471cc332409af3003ae2953b40c17e73a0ef3332143c2df1a8a6102f446558955307d8eb9d704be980a0dd37df03a24778465a1977d659aa16c86949c60f4121bbb7a477db2f88e0792886f0dd2d257957d5660b1044a293ab297f0c10b805a6cddeb59146cc81cfe2e12f67f6d85eb415deadac02f0943a6d096ff15e3019e5c49ae6887d4460e9562ec264252ecda4a6f472967d19d080faa0322dcfa3199cca4dd7d53620e3fd971d682ccb887ea02eeb6f7ee8c98788f17bbc06df120c12c7cfb03b48d066a9dbd8228b8c4845a3ffca379136217e75d865d68881d9317073e628fc836a84362ddbf8806c9b878b7b2ee142b93c0008fdb90afcce6903c9f5a87f4fa50422094f1081655ff8cff89af42a1b3567d7447c5fa8bf0b7cd96a00c99b542b1edae10574c408902aa75151c8ac28d519a27c5997deddb51fe58da8debb5149b7a93c038ddb221848ce1ff0640edbef69b86842cf5a26b4040edad20472ae4eb7e35b47cf40997e0e9f5b10d5584016d0ef49121b6bfc16c0d52302c84782bf19ebf40956a1b0d31cfa03ce7abe21d85e82ae1b2f26746f8bb271afa257a9986a9b49e476b1068f4e92e1ce0dff35d701f7e64d19048a19fabca6db95568865c54fa9bbe95c434f7d995e92cc6579698bdfdf84aa2269a62261c295172888dd28292f00d05e6bce7575b7c6fbc1d9625081a7c7eaafe63ff22e6a1ff72996a20944fc955235b94f99a7d3325ffe52abb3da32a0cbdf8e935e95649b1472b94adb6cbd3dbc7cfb7ec865ba56f4ac5473baf129fa0b24ba50566131d3da1408fbd29911de2593dc1ce9caa09068b9428133e969ec2dd672fbc4eb153cb4964e76e269f24ad70b9be73378afc9063787ea7ca98c0257ff84ffd7a3f263e8c1f6b062ba6feaef524a00b8084e6a5de1be5819c301bd739f68c0143db6ba72f29951613efbd7a22004a19405094616ad68ed3afd46736382c1be95f560bf839f450259d1dac77c80fa6377aed18589425978fa00bdb32adaba7368625ef87854e3bdc974360e460e489773c608b607aea5a1aea924cf33fd2e0fe81240059dd0f7fa454e19c52f167a6ebe935d558e7512602a923677525915cb5cab6ea2e39a4722125cb50bc3566bd7d901952fd3a6a8dac85045231345fdd4af39d9a07ff02fbef7f11f04f38b9056d7e1dd60b41dce44fcda96cbe92262461fb3bf4910b85f47a43d39796d93356bcabc860a67d0ccb64d27e652f2971617c19e7878645b63a5c45daf00c6608faea628f5bb1011971053df1306c9cd086ae546b02c25ae2a760155c78f9896b8b08e342d1ac84ee10209c980ca32c9d508b06fd70eb9c4fc1fd1964416b4fd01cf5ef1053618c4b616f1a3e4f5337996bb389ab199cc0b027264ef091455dbaed66e6c30d8b79a2d414078906634bb7dd34ae575ab0eb1470f3df78d9a803a8d7ca2c9e14e04d3a7f9f22c9c32c9ba2f742b656ff3ac16dbd7b0d34d1fd496a89265ba3e3b085c04d202f1e15f2e2dfd8d399b97ac575b83d004f75115827f14734a67ffd462585280409fb809b4dacb83844200d48a4bc0d889f870e901a272fbedf3e61e4762641221d6dd0458fc2694012f589b7c201aa8230b65a2ceee15de7c7bf46c24b9ce1d97ee58ba2581b0e510d8fcd0d0180c69a964be399aa6e9f13486d719e668305d606b41f4660a917c9ca470e2b017c5c46cfc1458d5cdb108805f38dd4540af78c95d999c1638fcd8735054eef80e7419d0608dd3487e7a4fc487040e7b8b641b3665ac7db3bd9cc3132426a3cb50eb8f803b503286385c12d8532c8b58769e820d846bf11d42f82371028965ed4ad501cbccf419b3c41da623fceaf835058fd6d76e8778f98e0911f5c3b3b78feb1acd463900286e76c4715441529e5bfdfd317a29c78512b08efc858a6c9da4595398cf5964e7202e498a17e2978f4a9cacea6abf70c342166dcfa75c96c9b98f85776ed7e2a15bc4d4ff96965e2c4124fbe3f8682f78e7cbc2c517561c735c5477c60fb6f34b46b6d888c7ed38b1ed9e5d09444030a75bfcec09a5f3cfe7d245afd59a99e5af879c765c3922afd7b37dce13ec524e06f0ece473a6f9d79d39a9e574d6785e5ffca5e7a301680c65ff901ec8f8e46756a150e8609674b32abda5016570fdf544136c6e2bf7413feff2ad53f458000682fc5c410c81b062e55055967018519a1fee1e1157147739a129a460c6a4afc227934a805641d496b7043878f3c5e182dc53a865777d259c6a51bd2d5b46d69f34e3eb4a0f56c9ec604fa20c3a2907c448bfa02d30c667d871704c5345c46b8c2da14fa374ef87d544a625735dbeb8de4459eba9d289e5979e26bd618769503710ce58510d9a2d43b687c5f5ffdb4a7eb1f8fc3e0d2c172a7eccafd5b865c7bfa72611395dcac8c1c2fdae76e601b4293149cef7dafc8c12174a3757d1ab789e3eacae30778b92bd2bf7cd25f11f51f51cf405ca61ef9b66fc5607c77c622e3283e1ad8bf77bfd38dc7d0cfac82cb61d01fc8a421de66d8e9a92ee0361d1b1f25b4fa5e90bcf6824ef07b771c0f06d59dc50ad64c26bb98ea725ffce5fceb2edb058ebf784a8696532af9ebd312732830ba50d9a44dd45e211426853af59715e369af06b799ca4c967bb3c4cad969709266d40fd2263825545d7ee2419be95f9e18ab8c39f3350ccc6bb454d1e12b8843ff1bff6c671d97f0b4a35fb4acb4531d8d363fc9e953d9d278a418ba8c06978a58693caa64eedcc9eb384f76f29a2d0916286f9c49799b5cfd81f47a412caafe0d56f9b513f62580b5eaa98e1a572786c48b69d9e379255cba7cfaec6a88e1afa0280adc70deabeff50f3b11e5a4ecadde8b7cae2b70b0fc251ceced633557a7839b93552e4b4af267ada153e095d5e79fde993e810b65560df42c39efbb6617af7c601222d7e3fd76dd5cb5e123f7349c834210bbb4357c7510b73a4d72c11ea563f8ef9edb4cf65c2ce66b5158e88245c8e6d30b8916fa0b744cec4ac4fb671a2091b63bbdb93bb140f31a5ae9d190582ae4d7fd3c567a59a6d5e3d6b59b4e8009c0fd8166cf1f56a1c0cf2ced4df17897116379a07918443c329c02b4e22858138da7ac431a8eee4b79cd17e609e5c90d1a2206f3a4d1b40c0bf2077edeb8f318fb7c02b700a261b2b650b0f9ef8512f78e48bd814a7fe30d207569a84b7d158f1892784ce317c8808571816e09ee953548d", 0x1000}, {0xffffffffffffffff}, {&(0x7f0000001280)="c445f28c69d8ffc2d927c4f7fae189dc722686349df3fda1897316001ba676acd5f1c117f3338fa747f5c48f7422ce9f9837136f179af40d28283d8db5ebaa37a592c7eaaf07", 0x46}, {&(0x7f0000001300)="939510a72140adcf1888d6d309b0f398e13709f626904c72bc97936c339085ae9fab549e462b028ebaa69f769faa05178b14eacbdfcb9b7386cf2112077a69b3e770b939616d8da569cc2def590a0c", 0x4f}, {&(0x7f00000023c0)="b7427c9ea194274d332451e0852423b6f47c7d18d4ec977283328a84bd75ecb277", 0x21}, {&(0x7f0000002400)="642b3164336888870b9c8ef305a2c580240a65d97db571ce7647f42eea10f736c66c694a77c493deea10253f5564581ff1342c1dd39ccb5c8a3455901e6421f6bbbe14b118818f85257c1dfadc35c1ef54cbbbb51c2f39696149d2ec5c91afb162fcb9ca98fe4cd3d21025c5566373b1d5566dd3678a6ba0d75ee593fb22caee756f46fdbcfd3194f68dd6ef4b7773eafa2a56b0213879e544", 0x99}, {&(0x7f00000024c0)="4d1cb6e4917b9deebb2b4e81e9adce341bbda64d0b2788faa0f0caac8d6e4187bc0bf3a70b445259a255d719a1cb18ae42690bb738703ee5e2608651439ed4f22cfc9029be98180da3590144604c61f00e6b11e1616ffadd63c2ac753c1492546e86ec1ecf19bb5b1fd2e8fc27c790506d52b248ae73", 0x76}, {&(0x7f0000002540)="d1828d09b9e90ec7ca0a6b1a9168a245d76a", 0x12}], 0xa, 0x0, 0x0, 0x10}, {&(0x7f0000002640)=@in6={0xa, 0x4e22, 0x81, @loopback, 0x5}, 0x1c, &(0x7f0000002680), 0x0, &(0x7f00000026c0)=[@prinfo={0x18, 0x84, 0x5, {0x20, 0x5}}], 0x18, 0x4}, {&(0x7f0000002700)=@in={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000002740)="2f148adc2c091ac89af0009217cc9cd5cc8e61c5da37f69d024bf5b09d6a0a72e2a85ec46eeb413df8c9e70c18ca5446777ec65f149c9c1be74b1b1fe49c18b9af401de219fa373cbe6ce411712fa59357b802d18bae29ef0b5dc3ce50c2345222fde99feed47f72f48333d1fbdfd9933f4257c1703c49e442ca09a5632e13425cca372894eabceea0d734e59a4e3d3ef8d621efe1ac09f4dc42836be734fc5e541d078d4a96523224dbbfe7f2b5b2efac8abf5ad1be7cee13b3dc7b1c4d1d4dbc35427ee91a4bec41f02aa24728389810835e96929ee1772cc6340e", 0xdc}, {&(0x7f0000002840)="a281c830ac7f6a2c29d08c121bda5775cac9fa27e11fd2a67cc6ca7586eee2e9713c0cd78e4eb8ff2a87a5ea25e02f97a8e695ee07919dd891108f1feba20f03624136d8d9896e15e1ae288a4a15f68afca60ec532613948cb724d59067139c110058b2fdee0a322c1970445f754a58b6c846af5391253649885915840a220e0088f10839bcfd881fb0030221931c4730aa98fd150295a7457d0d9162ef4c6cd4f02864014bfa2d1407118b9551dd7190e6db37b59600ecf010eba4d81015132cfba96c4dc1b2f2df3a1aa779f288d810785dc18a77e1442e0a066627cf2e65dbd33ffe362afa8d81eba2b611fe4270555befa1a24df", 0xf6}, {&(0x7f0000002940)="8a15e3579fd852f631299101ef93e242c38eb7427920a357127ca6946e2ce0683e62e081a1c67544e3845646b308cece44561be3d8a02b98e498e3e95fd14609e470b3b1efeb9bb23a4f3833dffcf7a6a4675c6442a4fda445ba91f2252d197e3dd58564a70cd2eeb104fb0d54208a268e811dae577e4a9c835f715f57008e39b8b742af0ed882bb800f4622422d1b", 0x8f}, {&(0x7f0000002a00)="246f0d3ff6ac96f1d65dd3c6768447f5e1c0843c3655b207543f3c6a976c20b8e62ff9480d44cdc9e554b05bbdb88b8c379ef13691c84e8a969553974a8d6df2ccbeb0a7e48987bc67508b441f39516579c7615de0a3056e7b067cfe873763d3385e5bcb7a9c008ac0549ff98c1ae8c3d1c54df86a6220f622ae0e9b5e0c66befb7da5dc164a", 0x86}], 0x4, &(0x7f0000002b00)=ANY=[@ANYBLOB="20000000000000008400002008000000fe88000000000000000000000000010118000000000000008400000000000000ff0704000100030018000016000000008400000006000000000200000000000020000000000000008400000008000000fe8000000000000000000000000000bb"], 0x70, 0x20000000}, {&(0x7f0000002b80)=@in6={0xa, 0x4e20, 0x2, @mcast2, 0x7}, 0x1c, &(0x7f0000002f80)=[{&(0x7f0000002bc0)="73246dd8756b2639477f6d7666115c5257e90a4ff160bb1cd69ce8d8e51be0fb9d50f104080b9041f086a85aeebf17572b15dea2dc22dfa68169506f17d8bf1abe2b8ea871c67f10a138e36fca60cbe8a824add240f7b60f38dc647739b578843609ba79be5868ba5812d0fca8c6f7d31d55bdd1848c437ca2163244c4a8e8b830d01fc5336fdf90af739a0a5837290d401f6a737fab8cd5678a33d6bfa561f05557107a022c24281a7d23409f80f77039fe32a218ef9d6606d7159c4f82bdde", 0xc0}, {&(0x7f0000002c80)="b440fccfd7acd1e0912e33a2dbed2a69fce6222cf87d04d38dc189056da1ff6ba67a3bba9311e921b2058ecfdc4fb00ee33fb65f364cade1e74cf63c6f3a489ddd66b2d42c1eb4d5c899d55eb40236b2241aee8bc99059fb130ad53e3dbb954cead192263161ba213e1e9823afc9e1a70de8e1acbbd9d41e8b444e905d6010869254cc0d7a58bbb888a2f6d4b6c16293eb0db46b7cb5e7f27461f08de467e5fa3337e80389fde9e060858ed503abc58ad72715d6b356db72415cffc7860cd50dff819265c637", 0xc6}, {&(0x7f0000002d80)="6606d504b7b956433540aed63d456471682bfe9f9287154b3303e7c22a1a928715fb10f85d760ff7a9fb75326de846099450dbb429c58b6a400a252e2e5562ab32a31a086c0a5f9372f0a3b361348d48e1ba78c2143e8fe3c448800d9c82734f943d878ca404d3a305d50734301174e206a4885cf63774df", 0x78}, {&(0x7f0000002e00)="ca986da303965b929a7ba107985b0b8feb77ea06ee3b47cee673877dacc391640ac00572060435969d42ff9396bd07e6dc53305d006622c91a914a01794519d79aa2a6fc365748fa4ee55a1f9a8e2ef491268e549e5374b647da2f3a085633edb2fb225e5986be42e5ce7135eb93f205da25e5c1c57c668972549cca93e2b856c739fe3660017356f29beb78e9226038e62f88933c51262193304662c80ab451500e20b42fd13314a6c33f5a5643", 0xae}, {&(0x7f0000002ec0)="9e8f92cc3c8e7f460118efce4f12b5ce443ee5eecf8c23f90ae6960ff78486", 0x1f}, {&(0x7f0000002f00)="9926531a5b4ad88bcf930352815227fc3fe67f0ac7b8e17eb20f8e501de897d05932f4f52edde4b57ed6d02afe22b253511362fd15c25b29da8dcf45f3b5a2ae09f38653392e07425547942ae33cbc587c3521de23bb10dc8464cfef8ae20e9493", 0x61}], 0x6, &(0x7f0000003080)=[@dstaddrv6={0x20, 0x84, 0x8, @remote}, @sndinfo={0x20, 0x84, 0x2, {0xd9c, 0xa, 0x2, 0x80000000, r8}}, @dstaddrv4={0x18, 0x84, 0x7, @empty}, @authinfo={0x18, 0x84, 0x6, {0xc8}}, @init={0x18, 0x84, 0x0, {0x0, 0x9df8, 0x4}}, @dstaddrv4={0x18, 0x84, 0x7, @empty}], 0xa0, 0x10}], 0xa, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000003380)={0x7e, ""/126}) [ 882.704246] binder_alloc: binder_alloc_mmap_handler: 1152 20001000-20004000 already mapped failed -16 [ 882.776552] binder: BINDER_SET_CONTEXT_MGR already set [ 882.794162] binder: 1152:1156 ioctl 40046207 0 returned -16 [ 882.820455] binder: 1152:1168 got reply transaction with no transaction stack [ 882.821699] binder: release 1152:1156 transaction 1603 out, still active [ 882.838168] binder: send failed reply for transaction 1603, target dead 04:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:27 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xd0, &(0x7f0000b67000), &(0x7f0000000000)=0x4) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x5, 0x2, &(0x7f00000003c0)=[{&(0x7f0000000200)="b304637f7c9fa1580b4e431199c100d8c497d0b42a449048e8c800dea77aa5a0b92564f72d426220c20c244ade844540a9e1f1d23baaccdba1303bbab2d0517e210f817c08e8f32ae868af1b820269e9724c4594cb6f4e4a9cd94b27632173590c7e9355f856206bbdd9765ac372aa1f272ed76af5e45f5ae812ce91c7388a97fa121505c98124d65c039c595ebc94eb93b043f938f00de854363279e87df9b031384b6370d32544f01379c0e87fbf036c0151623a7ca5cc3feeea5296dcefb415a626ba185364eff050a3e865cb1c5a6a6fc51e5b", 0xd5, 0x2}, {&(0x7f0000000300)="99eaef2511ec1cef1685cd80e48dd1741d689211786dd8b8fdef37e71eae846316d016a8d229a93edf2d17fe40d2d29dbb2e17bf0ae1e19c27d17ac54024e229c0e99082cec9e14ce2c014ed00b874658b0c3cc3e417d2fa82d8365c99ebd23df89a39373d5ecc4eec37ee0cf787fc811e7fe6b2d8b28983c0e176a0e0afff797940b1a4b84e43259ea0316210a62c5a892ea09f1caae5d42ecfeb6f99f67882717246edcbb17505", 0xa8, 0x1f}], 0x4, &(0x7f0000000400)={[{@nobarrier='nobarrier'}, {@flush_merge='flush_merge'}], [{@subj_user={'subj_user', 0x3d, 'memory.high\x00'}}, {@audit='audit'}, {@subj_user={'subj_user', 0x3d, '/dev/vcsa#\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, '\x17-cgroup}keyringwlan0:+!nodevselinux'}}]}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/4096, 0x1000}, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0) writev(r3, &(0x7f0000000700), 0x100000000000000d) r4 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x0, 0x1) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r4, 0x28, 0x2, &(0x7f00000000c0)=0x4, 0x8) 04:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 882.964426] binder: BINDER_SET_CONTEXT_MGR already set [ 882.984553] binder: release 1188:1189 transaction 1608 out, still active [ 882.991833] binder: 1188:1189 ioctl 40046207 0 returned -16 [ 883.002043] binder: send failed reply for transaction 1608, target dead [ 883.040402] device nr0 entered promiscuous mode 04:48:27 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x0, 0x0) splice(r0, 0x0, r1, 0x0, 0x10000, 0xfffffffffffffffe) [ 883.090480] binder: BINDER_SET_CONTEXT_MGR already set [ 883.105262] binder: 1195:1196 ioctl 40046207 0 returned -16 04:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:27 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x2) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) preadv(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000040)=""/28, 0x1c}], 0x1, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) sendmmsg(r0, &(0x7f0000000200), 0xd7a1d53051f19818, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x10000, 0x0) r3 = fcntl$getown(r1, 0x9) write$cgroup_pid(r2, &(0x7f0000000080)=r3, 0x12) [ 883.212094] binder: BINDER_SET_CONTEXT_MGR already set [ 883.218061] binder: 1201:1202 ioctl 40046207 0 returned -16 04:48:27 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x5d43b52a3abfb7fa, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000040)={0x0, @bt={0x8, 0x9, 0x0, 0x2, 0x3, 0x6, 0x1, 0x2, 0xd2, 0x6, 0x4, 0xffffffffffffff81, 0x1, 0x80, 0x8, 0x1d}}) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x8000, 0x20}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000180)={r1, 0x1000, "54b022ce6ece49827db94212a7bb04ab4ddfdb0ef107ef18d09212dd2ba70f59f984a375983954d55bfa0cc5e600eeb803ea1fbe07f524beaf2a580225200484b51ce096a5fd77dd97780b3c5bfc454ed4f2e46d53c80ea1fd7ed341088ff8c4546abc90f5dd6dc75a8724ff10a96a42f63bb4aaca8c3e3da79fb20222955583f7854503f979392c9f543c7e022ba189849c53317d0fa723a33a74d3656996d4339eaf0d0e299305f2234605ed596c21d16bc0f9ce0c21bea46ce8fcfbfde8aa69d8762e34db75ec6f0d02edd6ec809b122cde62d46af3603cb6567db10529fafae3b27e32902549944af7f909adb559fb98af05882822950fc43860c5e3f85aa53604e3087c7c7e73c0792df692809451dd6c15650b367a95d86015f39c39cee00636994de4392ae521054f249d1b974e4e3dd6c236c8f41fcb32f58726295b59d1d2b4e3b1ddfe70830c2a4906e7a323e1f93ffcfae2dee03e3a094acc66713916db2db120e421e13a2977e0536ac95aa3299a2fbdb7a458ca806730a5c9af762a23c3ea240c8674d223ef35543e008f8ba8501de94990163842f5cb179ee2410b7a45a45d5d57b1198d679349ac215ddcda925329bc16d18386054bed850c849f5c1cf207f08cdf45001171072224d35d3da594b56e44657a02f0e47eee248a5c90d90643171d853d5ad7f407fc3bc2e5431cc8e60c03c0e30308f3f4feedd51cd7ac6a35ce0ba1c6e32adc7dee07a1b3872babed39e46accbd72eb6c2a7e967d512a4e5b862cdb4c7314d30fc2ed864ffaf541df434e624e5e7bd9c6b1c87a390944407ae3fd66ee936dd476f060b0c59adaa5eb66e7bb4a07a4d168dd3b5445af680e457c60982251e1c54f78b4511425cd34a039b4b3f417541fefad644dfd18c2d38493129e648f67671e5dcc9a96e82bb90fe3bbb0ccd4480f3ad8f41c70214e4e94c6e00922749df1116572d42578ce0db2ff5ad5855a96f78b0e018b196ccf6fc1f1179df68296afb62f7c48384927a83144982c914822a6c78a19aa1961361fcee10d99a1f9051b850772c1dd8d0de9ae66ba57fa11bf408bdc30d972f252465cebff2707e9f0625f16cf599615a5b98cf372788ac2df27c52857e018e1bc0721d9a9f26db9945e6b073caa75e0269541bbc3e331c92519fc0abdd139ce2d866729d7995a4868298f1fac61293e916c620ff2c29f4f5851ccd19697b5a8a257226adaa83577fe3752fc2e19c05b157344bf1238f938457eff1d58bb87ae72b16dca1ed5b9433bf23b87fbb38ad3dbf89c78b2ded159178e917ab79d6d4acbdc970d533fbcf61d4ef7ddfbd616b01e483073a71f432cbf6a58839f89b05329eff2d4e094fefc3be9625468a4b5b49c8d276549e11e5db23c7866a6a76cfc334bb5b8b86a4f817d76e5c819a4526a7e20685ef846db97c41cb967487d3c22326a470518d3e561a508edad390cb304467c0373bd82ad0d35dde86c9a6eb6b208acaa18d2b8789b34e649e9fbb51dbd757175653f23f45d9d124d9091983b4ee669ac5e41013e08be2d1537cca215569713936aeabb9c633b5d277df5c838d6a8c73b6eb1b9a6c92cd63fd472491ee054909107d5a666a8626a61d193ac6beba971fa719a5eac0d0b5441eda4a8b57df052f4bc2d6d34351c02a3030234bdcf1456dc9adea0713e2e8d7ff22b7c3848f0b7437ec99e4761c7862b333141857fbe63c5910bc97124f20ee20dd4b3af7e87c928a687d4ac531c2a97c6a266bd778720203903ae7086c5d19945003c8f97b5422f7168853f9790b74fd9e58ac6a1b912e748681bba7888d6822c3c6ef60a30e56aa1db9d2e7c583116ee3853798374076d1a11b30544bceb0d64b5d3b8dd5b39f1434464009a41fc716393151654dd435382fee11df9782219bf516e26483895cf67b63b13fd494a0946113e95679cf4ff9292f2a48cc59b73f7d68bdedd9035bbaee63b7c86f0f1fe97b48b2bdae8756a3af9425ffa07ce729d7b088c9180ea2cbe55cc28d226085efebede76e304577ccc5587b59c5eac2150642c734f3c7766ce5c7df0ca8ffa5e1689e025da9f12211d27ff1546981a825a4cf29c9bf20223d7ca0401b6a3f22c3bc85c62222ff594477c4118e84557b292792d3a99702498d218d4078714574c50e36e875b744c5083b1257b5de688944baffb3ae4e9e9858e68ab487ae3e15921b6edc21ff922b94b36da9a6966bb867f92ed0715109b6cb7fb2f10b8803451b40b21cfec2911f1a9ae93e57d1126c48a07e680947545a24cc9d978e216328a623d8d9159b37f9ae83a9c9db80636f74352c543dbe39f67bc153fffda6aad080d658d3ee68a3a4d8e665ed6b16c3adbfa4cd249a14c5ddaa95eed9ffc0c545e0436b75773fa2d496ebf93d5e7ff3c402ba1d3340ef697c26687f2eaf1f9862917199d021c1677e5178803461ca0cfcfd160a7c1796b311af7c48ea778b1f9eb1506b7dd450ced74be3676120d0be4dfd0e37eda527424b1c2b4b07634eae85bb4c737fc4fef4cbe767389133515944977cd1bb67812b7cb1a21f88743e312bbc68c357af848af7b9158d9cf3b88c5ee2ed5666b49e922c84120e32db693fd8228e650658f3530d570656cb5d689197952f09bb8852f59825a2fed2b76356000a914ce8839a75c8e0a68845201b8995ec6d13398c13e1d2176856818f5ea1d243096cb48b7e351ba786f1a83bcc57812bde11e6a99207b7d92f267f917addd9d6f0f632726e5a0e0d88a7be7171f2614af735dff8f08ca9400aad2901e320882516a363bd002f62a54582c7fb08d6c7dffa2f77b9251d125cb520489370e9e66835d8b82a9efd56b13392388ae462397671e93495e3039abc98a5e49391569e29dae5a61dea9f0f007496a4dd5e00c38c0e03b8638c6551b1bf46354a33074aad258f2f6568b34d5f219363e1f5d666c08b828d16dfb6c8645965a90732db500b68a37889a3f7e69458338cb720d468ffc5521e9d5b3cd02ed456df4ca2dd56a5cc178f62cd17fdc3380aa4b12fec9abb0a54fb372232debf6b5b1fe36e211ba15b3935392e3f76858511fd27eb1709cb71e9ee158524f08b6a780d203f0172c1ddeb10a94aa12252c26d8e50a3e7268a55590f89c6b88eca9b2035dfe4aa988513d04b6b20fa3b2ce9d478b9654294cd516ad121e7069b23f945806ea5d957ae38de1dd05cd9f5f8c2a28b5f672e998b255a62dcf07c97fca01d9209502a427ce1e7506438b7aa76a5c5f46487555958371e26858766b5777f9345b475b0a23525de3579cb0ac6ca31f3b80f473ff450a7a196c6187a52b9a81c1aef019487b73c0966edd5a6f2abcbca8679b570d85e435658afcbef0401df5f96cb55b69fa57335270d8217244757759a2095e774d377877f109e49d9afd2b07ee2e24ba9038e62047fc219ebe43d085ec87fbd13f907b1edd3cb4ac39883b7ed6667b33998307832e168827bf6e225d565c1d6a6a1db9973639ed2d6c5419524f1a6b3f1b7d74ddc99ff8fa92552d05041697a9705985d5c5f5d0301a3737b53d75b4795ae3a15e64f5702be122591714cc6270525c01f87bfe814b3152f3234063d31058a8167dcd126fe7a20a46e9f140bb16549b2c1d050f0e1f7a513ded7d7851f8a7ffbaacb36a4ea0c0b0a478e4e8b3d90ac649d876a96ed678bfa7a8738e93d983a396fdc35b37f3b965bd096ff513b0b0990609f49e160639b41b05e17d0539aa343f964333edaff88a8843cf4dc29429db93b98b372e3c8e38d9cbfcd37d084aa52a6ece7c3dba90b4346a264c9491c34861b78e4268a7e4549d61f81a3cfc88cac803b91cbb1df1bcc006f1e4ac0b2fefa4f158e2e48b1505db1727843287c72b95afc308b9ca60edff65644ee417f0c1cc274fedcde4f148062b3be72752be24edd867a9ed38886b570934eee65030788182b7b64479e189a22c1b05e38e8e310d0b8c2510a677582bd92e7fd53cb5ae390e19399a5c91550da4e73be94368919fe3d014b3c0ee1799c984d2a29dcebdacccca24d401e05408aa62417e2ebc97a727de4448ce63a2e75d9ee5772c8cd849c4ccca24b6beba3ede9e72993b7fce0f0d4d7f19be719614614e56d39abd1b17a8eeba9f4527f1bee48a2b58e5e686bfea563ce39be0ad745ac070d2c313c5bf96d0562169541175e35b4095100483dfcf95e9b29264a0fc05fc5027c2e1bd2f5200780cfc3be7b62dbc4c4da763624115ca7a5429018c5e7e2086fb7fbf40a386b8a7a553c78cf4ed948908744fd7e11323718b8b27c1cef2b337b867e23a43ca151c5526c1c3ea2d6faf217fd438fbaf9940de04e704e7f988386f4eac47c844447a537dfa91aa7af399bff0b92a8c02ae12332db1be5b12ba7ee45a9dee6765d8a045cdf825cdd63f384bfc806f1c11c13b4fb523396c1c76c5b1d08abd8f22255f8f7a2157c628c072f5d0d5a25617d63cb2c7c104a3301e5a88eed6abeb141c5b9f9310af8391daa04f7a9978c7cb123d5b60f5cb6aa2cc3e0462ab2f5f3694c4125b5a8856e7e953495566aac283f1074adbcf121ae5d86ef145a90a8dd36eacefeb4780a6de82018ad2f621547386ee270586c32a857b7ee07683f61bcd4cf9b7e362db585b519e8e4625e9af7103f6623508fcf71b39291bcbbdb18e6f568c186fe0c423c70cef344131aa3efde6d13946e282cadb111cbb506f782a54927eccf309c21b0e7ebac0377942f68c4cfd44b36afaf60fc8d7b0afb18651dcef7bf62476b7ea97fae1d1a37f8ac6cf0ec5d8ce394f2f01c426897b7402f2d3c806b4313fc66687225a54400298c81c48360507d24c30f4a795afab7e0eb06f507198431dcea88b6b089ef180768ebb29d01c8daba97807637c3e1d38464492efe63f3bb4fe76cde44a6cc0fa53573e7adc9376fe42e5f4cc6180d52eb06e8f4e16be08950ef0b95772aa7013b917db53876b60825be2f435559c47ee0ec9432d26344ff645a7b4b0d364c7fd42e0710930949790d63518cb2361a20be5807fc82560b6467ee0525bce391f4f9c812458091f7d10ddc91f1734b116fe61fc3f75f3cd752d99b086285fc31eb2b18df4cee6a7cd8068403c95793a7f771dc9af34f2510c405ee78a98d14b0086939a754d7b071de645a99dcfb349b3ddc355dcec63ec9a91237d9fb1e5a65db470b28b14a60b9b3626bfeec091a80087cadc0d969bb300987dc6238e668669d50a105f81849f490278e1620a4f633cdfe7db665c6f9e14b2797fb840af78bf8d555806ce3f9c6275201bed92961bf77e89757d9d0a57b4cdc46aa667c231557784c745cc00de7f0c393e0e14e060811bffcd3437f21b7b0f05edbc9584d036c0b6d9dc808886291a61e874f2b53610f65d7874361c8bee1fe6bd1f6c1479c84cce687287120030c86163b8c14c14e32add70efd047f566fdb6bb4c21a206a83752d4822d9df85439571e2b0509d64615ce7edaed86ca09a9d8c392da23bf6069268ecca696275909377921b3b49d08b21502f10165ebe8e2090cb68c03f47b5e1bc03bad25a9cf1c5cff8fbb6d3615d5dec44409e09a155e51353da980c922427e56290bdb4f1dfb8f8c8ffa3e1538ef27e600da78a91500ec0fdb44dbf3e2c6a6b7e92c353dd764e27b44dec92aecc17f28200c8270db29dba83d47e7d61e8f47a5beb3a3112a00fdb8113c166daf6428f418b66444fb4eb4c4a917b2d1e0f7aabbf705537fc725880d5138d3a2087d0449c9c3bfc33b28912fccbf5f7530634e9b"}, &(0x7f00000011c0)=0x1008) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000001240)={0x0, 0x0, 0x8, [], &(0x7f0000001200)=0x5}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001280)='TIPCv2\x00') ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001300)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001340)={'veth0_to_hsr\x00', r4}) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f00000015c0)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001580)={&(0x7f00000013c0)={0x188, r3, 0x201, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x30, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}]}, @TIPC_NLA_MEDIA={0xd8, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff00000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x18000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_BEARER={0x58, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000001600)={0x3252, 0x0, [], {0x0, @reserved}}) clock_gettime(0x0, &(0x7f0000001700)={0x0, 0x0}) ppoll(&(0x7f00000016c0)=[{r0, 0x80}], 0x1, &(0x7f0000001740)={r5, r6+30000000}, &(0x7f0000001780)={0x380}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f00000017c0)={0xf0002009}) ioctl(r0, 0xe3d, &(0x7f0000001800)="456baf33830b5baaed5cb5577fbc3d4ca47bcd14bbea20162b9d54af86f61799793b4b140480c6a83af9e53b5f977edd0ed37e5d06ade859ba61a68a2158b68efc6314db9426dfe16b6be483e1627d43355add418a01d514187a71aef359a0d64e6ab3997f4e155dfb66dd15cdf4bc403820a2431c287e4a8dd77ccdf765e573848875cfebf5cdb7de2c6d4182d89a464b674ac15e729b09b0e69e53dcb286eac11668b63b57f85201994d97f8cd494337509a36e3cfe7a4b4438a540d25c9db6eb18dd952cbf4bbadeaf425eb2976bf7d638f25c38c4c55fc77e448479c86aa65cd51b90e2261ba26495f6091b4") ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000001900)) semget(0x3, 0x2, 0x100) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000001940)={r2, 0x2, 0x30}, &(0x7f0000001980)=0xc) modify_ldt$write(0x1, &(0x7f00000019c0)={0x1, 0x20000800, 0xffffffffffffffff, 0xbcac, 0xffffffff00000001, 0x9, 0x0, 0x8000000000000000, 0x6, 0xfffffffffffff800}, 0x10) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file0\x00', 0x100, 0x20) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000001a40)=[@in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, @in={0x2, 0x4e24, @empty}, @in={0x2, 0x4e23, @loopback}], 0x40) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000001a80)={[0x5, 0x5, 0x8, 0x9, 0x1ff, 0x2, 0xce2, 0x4, 0x9, 0x0, 0x0, 0x0, 0x1, 0x10001, 0x1f37, 0x8001], 0x0, 0x38000}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000001b40)={r2, 0x20}, 0x8) socketpair(0x1f, 0xa, 0x8, &(0x7f0000001b80)={0xffffffffffffffff, 0xffffffffffffffff}) write$UHID_CREATE2(r0, &(0x7f0000001bc0)={0xb, 'syz1\x00', 'syz1\x00', 'syz1\x00', 0xf8, 0xfffffffffffffffd, 0xa82, 0x0, 0x7fffffff, 0x8, "5f3ed1a5db3c449ccb77deeaeceb9a2a804e5fe400393df575ead8b92f91347a251582b01ab04d87eb1977fcfbc48a3b343b36b6c488dc446efc33b201886f098587d1c98c202a62e7392198d795a8de9844bfb0ab0056b7ae62b28c00ee2493d49f96ae134388536cbe4955cb25faed37e2e33d18cd911f7384b9170424dba29948acbb32c5e2f03831aa4954c0cd5ff972e79505291b5852bb3494a29927a74d47d7b95aa400c953c07bdce0a0a5dcc8bfeb65ebbc9d2331bb082a4196d56ef205afb452cd91c1ae94838ca9bd9e9a5ad06495ab9b0751a1753baa40bf1df07eee97acb1d568a4430855fb98de6f436d9283b8090f3e46"}, 0x210) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r8, 0x84, 0x66, &(0x7f0000001e00)={r1, 0x80}, &(0x7f0000001e40)=0x8) syz_open_dev$sndctrl(&(0x7f0000001e80)='/dev/snd/controlC#\x00', 0x9, 0x4400) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000001ec0)={'bridge_slave_0\x00', 0x400}) getsockopt$TIPC_DEST_DROPPABLE(r7, 0x10f, 0x81, &(0x7f0000001f00), &(0x7f0000001f40)=0x4) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000001f80)) 04:48:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic\x00'}, 0x58) fsync(0xffffffffffffffff) 04:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:27 executing program 2: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x100010031, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0xa0000, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000016c0)={r0, 0xfffffffffffffffe, 0x3, "4c818f7fad17af679714e820d4cbf45906bdda4eba073a1235d7e60cdef8869b51199af08187b04d549ab63b310522623982ef24c1983b7919753b89036d6a2ee8192a1085d4d42ecf59c481a1131790f0ad7cbe415706b7b3f0cfbc83b1af22dfed588089f39d77afa881b90c8c79a0d8ff0c4e1b1882f7c0a289495acd0f665c5217743a8834980f8b01c12c7d22122680b92b393f409eb0f7b010cd530172e3b5747ef1eadacf14e3cf5fc432318f48a884139fc29c1bcfc7f139ade12a43b75c910402c5981f93ab4e63224c38ad4a9ead067f04b128478074501b8d0d61d050f01dca8cd07953d8e7190b871d7b425b0f70f916cbfe926d8b8c15606abdd20b6d393931ea24741c7b6f59ec3b019b300e60f3ca8042791082c0d8d2ba2c40256c5fb1d1d850bb08018f4bbd269e9991ec6c8e3cb6c70d5e7c97d859d69c2879a7d24e8182ccfce73f1dd5e62e7f1ce9d19f7610e111f2b371977b24eb4eed89984efb3af13feef04e9b0b6fe99e2fd6755401a772842a885a0b3ccd6df040b9af0bc89458339c78f1cc6ff86e40c96cf843cfc4b7d4382c35e7965a4d0d82bf7732adaab1878b7ba9261523584e9a2884b54b161c61424c7453f072e04833e6a81a942d98cd58d38df3d9c5f3df80df6fb717277a18a2c181d3301507fb8dff7d29d4739581aa7fe3d36e2e16dac37fb013c00f0ab9359d9751c976f969fdb9a1725180f9ff3e882134c64c2f7219a4944a545f1564398cdc57d4e1f2e99a28ee2a925c0f94b478cad55195d5cb2e749c62533b719c92ad5871596210925c66a29c6c6f75b9e4d3568165dd0f9126350b3fd283d18d5b4f5215d308007a00ab687fb726777926dad34662707df20bc8d85356364c2717d4fd2c94910b3ab7c9c7f7dcb1f4c71fe0c48c105e2fa77330de70a4030e71a9d801f53ad9275759f37d7e18a4f3862efdadd7fbadeb3dbbfe7db889b46164775b382cd8c546373cf3a80da9e98ecc09c40581df6912b9473f34c4321625586fe11ce7c1e82c4f319754aa3f4bc08aa4a482ae5152282d7b472bb668151145795b8fb02770a1fa9038fea1fe9adf1e9d04fd5c84fb05411282cd4034ee9bc9c630c2cf15f08fe6ceaba9960fed7ea90f88f0ffa40d8e3c87472f6e2f4384561429c8e6635ef6a51c1e9266ef24b5c5757ac764f976de52ed6cd69bb2386d08276f5f6ce2d09be29c946e4471bda846aad6beac020e0a9cab0f0b5c4a3768f08aa89bac181d9cbe17772789242e87082f196448e9ba30a4cca3355533937901269b789ce5e7fb57211a022cf126d00b59e8f5d6db685943402b93f38ef9b5e539a09529fce6fbd8c6544d79f37af45055c6f6439cc163760db247a9b51c6eb85463cf414e4d5a5372f74bfc598b4ac2d160ae8be02f29f5bc2adb236ef720f8b7da8c18099e60aaedf279d961199d9dc12282a5d47fbe3c2315ee49b81afb216a1158edcf65433928ba9c616ecdbbf39c53239b9509cf10c63d62c0bd8a05216a915b2014ab081c3b057104e1c4c52fd5f7fc37147a38ba25cd325276f9ddeb630dcb90daf2e0db0c8ede281cac37ac9149a325b81142b58630dec2a48722e2d2862e938ef4f8a5c59a3a9eb959cb1d68547dec41eee9cb32b3da7bc495ca19b6888abeabfa4c8c0a6e40a2c5a94d5ed57c1cde7af578228c2c5ad4b0c2b32b5babfdc9dfdce25aefa9aa4a1a0673dbc00de7f79979d907a09ea7a4b03fa20b2553f38bd5a7fb1b40d4a9245ba9e38d9918f0e0a07df4cd835067ef0068fdf49ad256e865078682e93aa8f4c7617d4ff665b187c6f4db1ca96bab028dc37e15f8fa4e5a6a1bb6fb2fcb22973346e604e670933756e21e8b785c7fcf7894252ad5b83be484c25801a81ae7a20b7e14a9c5ed40ad733cd9836367bcd919f20a3e8b65a823a7b674c9f3236e30ec55187bf06069508ce034f25dd9cf1316b775fddd5319b91648f8116030c6edb02330316ac385d2a01d307fedf40869e13dafe046313ae14b389406eac41ac99f7a5a3f937dec8435894c3af9e10af3da33b174cd35e8feae15d714b6fb71cb9159085e021a5800d8ea788e69fa05f48282f7fd845cb9ff153638f07fc828ccd23748d125899cdc46054bc7be762addb7d5ab092812b5d5c79bd515e7857d5815d07356dc90a93150be4bc7ad7c2e37ed7d47b7ef8b8eae6dc1cda270f7e59e7d8114d4dbef3eeb1bcd91c4ad7775d8b3a1ff3a68b5b1e184b0359082c359d85ac356f68b83441b14adb7152c843e56992c76cc835106494bd4e7c676dc401ef3b690cb600d0a7ca266f297dee16d274ae777828d484d39b5d0195cadf93b3de0d1ab125100efaec2e559bf4fc2f08477b5449ac3c6e49a7da9396c855ef8e92ea66d85d843694f5b84f3b9d31c1691c27d65bd4c5f0ec777156459c9d70927a011e042be715ba010f1ca5e4595be1552b43bdbe431ade6f4d08f3d28a499be4d4ea060510249fbeefe026aa45943ed629d50fe5ab04847d793925636ff18f0860433818645f02fcb40be6242425a2e1bc9fccf02da59890e33183a7058c7483e615908c4d782282746c86e41189b95de208d3928ce7a149217e8d199569bd181972f98535895525f797eb9e1eab35a4057b7f0c9e16ca9239a30a14fd57805b8177b6c3135d8cc3e27f1903221dfcde272cb88c6ae677497596121630179a06e30ec5df3207fa41bd35b92b92cc8b3d105fc81ca8de574701be701da3765fc028c5f0987037458d6572c9dd3423711dc38e5f8ea80661005d04de6dd424c03e6dbf8551eb6af9aa8ab08c23398ea20df150fbd96d72b71e909022b8e0b826e3883e5a69e6a034e0325507c32300e7bfcfd2ee6928ce394338204ec2fbf22e367bddde47b47347dd023cd8b3741f2f223387901b76e449e44a255745db30dec872427ffe95ada317387c18235754c49cb355edd657ed6985e6037473769e56dcc26f2b2c3c4abc01adedfa747c43452a72da158aa082e5dee348f663f5e42c92bb4ae93817313bc686e61de1e7d0d668200ce6bf7bfe3468e0cc9628717c05d4ef646a778049a8342291e0e98d9d92d426e6b5413a40204555164de561205237628fc88050fa8f92128301486188dff287958e35b8d4dbf2cbe1da37a13602bc86c044505f5fd0976f7682cc84a6a97ea5e5e869d6bf0656ac108b5bc6ed6cbf28b2861bd8585ed5742c952ed7e90fa247c1da96c830481f73d92d5db2a1a3d226982072afbdb3f19263cd8084650e561cc7b2a44890fab92357d976341689204037a3773120f558f0f009a0a1bc960a0c2ff0c309741cf0202c5ea27ce349a986b96afdfae79c59760cadca17b56470b1d244c620b0c8254ac3516a660b4ba57dbaf279d9b37f99eac96d1a8998c5e932783b16ddbfc21f081a8d136e5c54bc7db0893427ae80b8d577a0b7a23ac9e7ddc2f6e75f3182d9a2bfab76534aa5bc47106bfaca9f7617ed30b46c8096d457b2d19c66a71b9cb9352c980eafe1e4516a3e68a18335a8be71e4f4fc559e1429d94f5caf46d6a9563d719cc2d41ebd8c7d7bc51a61d100b39c654c1e28522a8d0ef0cf3eea2f9f6093f44a389537b92878386a5ade0dbdbd824da6517123cf67507626d88900be10f660d191a554937c0592299e1f423b7579bf7b02f4e6248a814c0110e9e84f95e923a8ea68c8901e386689e7734e544f4527ff71a35493197c652283cc343ad489c4dfa9bc45ebe04e9029f949688dda621386c579952d7f3d0dc6696e2397c9bf321f485b6861482bb276c0c480d6fa9b204dd47822f918125b96d111913466bc49fb175609179c46f8ef23321b4320c79d2427c9987528865c9b1c8db06e5960e3a4aa50bd298fa29c19a397d2e2139f530e7fdf764a145e40fde49fc7ae897b180d76785b73039e33b6ecf8ef0acbe81e6b2a5066e2e46332bcff5a822655d9da4aad4e7a898d0cd771202979b1b1f3953cabc1652a30cdf66e133faa0089af6c75479783d04637a4c6862859a82d87893d56484ec33951edfbf04d1598e795f51b31e061954d3d0757e96948cdb3b27e4280d3687ad7e012fd5217cb5dd8186275a2135726b9a19ce7c2317025cd384745540eba9bf8b7f134629a3421b1223b89caec02c57db6d075079a537c98c9c8d2b0f4e1726d681c757044d170f726e9c2bab7c1dc7fc17d5991c8adeaaa736a0402ccca79c97e9bcf0fe3fa308df418f79a23054de2d388c674d00d4a4912de0e2e4326965bf7ddb2f75359f1ea3e1c766cdc3432c7d4e7751593107073f12bcfbfa1323350c6852b161e7bb8bd7b9394ce75062339f4df3d878ed0aa03968e46db3412d23c6e993e184bb632f6ee9b93ec8da5c6847f2697f158d858826e9458dae5bbbda98594540d5cc1afd5af244c0164f5db40b516f86dd15dd9254cd20343840aeea43e0c36321908a951b80cb6e7b89c80e3105a7dcb6fd578e015cec3f6d5d2ce872fd87560c2ff812c3e09e8faa89226a19ad18f53a4d5a99b70ad3e8ea1008d46b9c7f15effd9f965cc72b33b89950fbac3f203f8cea920b61f265b660f4adb48e4e40115d5f382646f4303c048b8aac8599895087871c4a2918aee712f50847af099e2249877c7098b22165996b46ec20e6eae77782a548d0a7bf0fe9fd54c45136bc896a6c7872ccdec4315b8b8de8a59a5b85d2151ac705aafbb5e66ea2ea9869ffbbb47fd2a1ae73b3897986d9274d8883cc5fb2dd9d259ed0b7352d7ca24d57d0b37b8f761d39a6c0ad12668bf4bed4c715cfc679d97e41a4e9c7857da4e73720652fff7a3a2ff977f51be1d97eb7bbf2c6fbbdacaacf6f4a8784ce2cd5ee98e7dad65706f184c9b066b8ab628f63bf65e9dba7b2d18a56b6021496bdb889f96d1dc693dbd4f808bef2ef0365dba5e11b15aa7bd9dabd41f0396a3f47cffcdc1542bb42c71492884d87ecd36048ce5cca64295fbb0babba4a7127ae4a152c99e0b2f4caa22f6ee2b45ca83e4de4b5b65a17c88150090c26dd31b3b0911d6de83eee358f9117b66cd26a8b06c450dc27d0d814491620a96d1ff1fd032724d1618b5ac4761df90894239ee63b4dcf2225d14cbb882463ce8e5697bbe3ec99a528b7f902fed1807fec059e7a785af9f1c5a829e58296b62ff6a1bac0369b975d108528fd8a515192b88d8c3a29b81df1db0f99523aa0b4a214662b364904a0674b9c76815eed1a9389ad1362e13674c75817fc685cdf2cdbca565fc17386fbe8a9ff3ab6f6a40cc4cf17cc52714ac809f97f4a32a3262fa1193cf6329deda8bb69453ca63511f45b89af6cc2324e78d4a3b9cc3f12d0c9707fc8bbe518bcd34555b2d79322727eec494af5fa4a1964c3458e1aff4e63593942cb9f6db013b88034cc49156717add1375a95cb04ab3e5d8e27cbd8c79af20a1b23335f39bb539f1d392d374c6f5d15daa9237c88afadbd5ab213e1e0c14712b67c3694ee83fcd9c1481bd338f8bc16f0f4f00301cf0d808f102f7ba747a2283efcee9bcf3dac30ad4e13955ef56394f427fd454d1e4032b895583d175256fb8e6d74fadc145187f196c31825db4e28559de0b20f715229eb18fc295ffb12b96440e241de8483cc980c928bdf7a18d39b7769c54c6845d0b0bece012fcf234e69b9de52d01632ff2a5faf4aadde5629190e58d70c1ba564ae2f40f953dfe064a511343aef083d11bb7e90234504559221e5806747a71f92aa3f8e7e46f3fdd5a24b5e8cb702a25d306255aedb235c62f734ba"}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000640)=@nat={'Xat\x00\x00\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x90, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=ANY=[@ANYBLOB="000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000"]}, 0x108) 04:48:27 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000040), 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/current\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000200), 0x1000) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) r3 = geteuid() setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001200)={{{@in6=@mcast1, @in6=@local, 0x4e21, 0x8, 0x4e23, 0x1cb, 0xa, 0x20, 0xa0, 0x3b, r2, r3}, {0x5, 0x7, 0x8000, 0xff, 0x683, 0x7, 0x2, 0x5}, {0x6, 0x10001, 0x1, 0x4}, 0x8ac3, 0x0, 0x1, 0x1, 0x3, 0x3}, {{@in=@empty, 0x4d3}, 0xa, @in6=@remote, 0x3502, 0x3, 0x3, 0x58, 0x5, 0x8001, 0x3}}, 0xe8) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, r2, 0x2}, 0xc) 04:48:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 883.500054] binder: BINDER_SET_CONTEXT_MGR already set 04:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 883.532172] binder: 1215:1218 ioctl 40046207 0 returned -16 04:48:28 executing program 2: r0 = socket$kcm(0xa, 0x7, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x22) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@generic={0x11, "0ffba887f5602019d30086625cac7f9fd0b3e525006d72f0a2be135ace5b115beb1f2c53af48ac3777593e514c3c88aadd7eed58c39ea9167be1e41afafae07affbe02bb5b9bd8754974c1f2152295a90e7555389f60e4c55555d8bb59528161dbdbf5f3080bed070d0fc3b2e9ea61816a8f4545a1dcad83f00124b19ee6"}, 0x80, 0x0, 0x30a, &(0x7f0000000100), 0x18}, 0x0) [ 883.631104] binder: BINDER_SET_CONTEXT_MGR already set [ 883.645201] binder: 1235:1237 ioctl 40046207 0 returned -16 04:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:28 executing program 4: syz_open_dev$midi(0x0, 0x904e, 0x0) getsockname$ax25(0xffffffffffffffff, 0x0, 0x0) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x101000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000001b40)='t\bnu\x00\x00\x00\x7f\x00\x00\x8c\x00\x10\x00\x00\x00\x00\x00\x00N\x1c\xc3\xfe\xc3.\x12\x1e\xcc\xf2\xd8\xd5l\x04~K8\xff\xe1S\xfa\xc1\xbb\x8bx\x9e\v\x83\xf6\xb2q[\xfd\xd8\x8b\x1d7\xcc\xe9\x82\xe8Y\xda\xec\x02sh5\x8d\x90J\xd0v\tu@\x13\x94\xd3\xe2\x8d\xec\x914\xcaKy\xe9K\x9cP\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa1\xff\x96\xec\xf8\xcaJH\xef\xfc\n.}\x0fnvI\x83\xa5\xfc\xd3\xe4(\xa7&\xab\xd2\xd5\x90\x87\xea\xddO\x1f\xff\x00\x00\x00\xdd\xb1\xc6\xae\x0f\xb6\xfcEq\xc3\xe6p\x95\xc7x\x91\x9c\xf4\x10W\xfd\xea\xb3|\xa1\xb0M\x06C\xf1\xb5\xc3\x8a\xaf\x1b\x98\xc9c6\x13\xa6\x94\x14', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400, 0x0) pwritev(r1, &(0x7f0000000340)=[{0x0}], 0x1, 0x1081806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000380)={0xc84, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1c, "7001e0f57c8cf6270b24e415e96042aae51d871554c11cd59cc80000000025bad6b39d778066f9d1ac8a570e3a42f70a7c0f30f66157a96aae15813f0dceb297", "a8a4cd0160ec941a3de45387daf7b1ac786d0e8a75e8904655faf6f2bc6cc487d93a61edb75c8d51c055faf7f4fdb16e0cdaa4276939a341033400", "2f18ffffffffffff4116893616105829576914e70bfeb59800f97c97644ab8a7"}) 04:48:28 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000000c0)=0x0) perf_event_open(0x0, r1, 0x0, 0xffffffffffffff9c, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000200)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x8000a0ffffffff, 0x0, 0x0, 0x0, 0x6]}}) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000002200000400000008010000000000000020000000", @ANYRES32=0x0], 0x1c}, 0x1, 0x24a90200}, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000500)=""/165, &(0x7f00000005c0)=0xa5) [ 883.760176] binder: BINDER_SET_CONTEXT_MGR already set [ 883.792538] binder: 1246:1249 ioctl 40046207 0 returned -16 04:48:28 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:28 executing program 1: setrlimit(0x8, &(0x7f0000000040)={0x0, 0x2000000000000080}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x4, 0x4, 0x8}, 0x2c) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x383602, 0x0) ioctl$KVM_SET_PIT2(r0, 0x4070aea0, &(0x7f00000000c0)={[{0x3, 0x5, 0x7, 0xfffffffffffffff7, 0x9, 0x0, 0x400, 0xa21f, 0x4, 0x319, 0x3, 0x7, 0xffffffffffffa710}, {0xef, 0x8eb, 0x0, 0x1f, 0x80000001, 0x1, 0x2, 0xe167, 0x5, 0x7ff, 0x20, 0x0, 0xee}, {0x7, 0x5, 0x0, 0x7, 0xe8, 0x1ee922c6, 0x1d, 0x0, 0x9, 0x4, 0x7, 0x57, 0x5}], 0x80}) 04:48:28 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x3, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000100)=[@in6={0xa, 0x4e21, 0x800, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}, @in6={0xa, 0x4e21, 0x8000, @mcast1, 0x8}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e23, 0x4, @ipv4={[], [], @local}, 0x7}, @in6={0xa, 0x4e24, 0x8, @local, 0x7f}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e21, @rand_addr=0x5}, @in6={0xa, 0x4e24, 0x2, @loopback, 0xfff}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e20, @multicast2}], 0xdc) fcntl$setstatus(r0, 0x4, 0x42000) 04:48:28 executing program 2: ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x80000, 0xffffffffffffff9c}) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={r1, 0x0, 0x6, 0x0, 0x44}) r2 = socket$rds(0x15, 0x5, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4042, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000040)={0x0, {0x3, 0x4}}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001140)={r3, 0x10, &(0x7f0000001100)={&(0x7f0000000100)=""/4096, 0x1000, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001180)=r4, 0x4) bind$rds(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x9) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup2(r5, r2) 04:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:28 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)={0x0, 0xffffffffb889d23b, 0x7, [0xcc42, 0x3, 0x7, 0x5, 0x2, 0x1, 0x928]}, &(0x7f0000000080)=0x16) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={r1, 0x9, 0x30}, &(0x7f0000000100)=0xc) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x9) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:28 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 884.396028] binder: BINDER_SET_CONTEXT_MGR already set 04:48:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "0049d13d339c3a83b57716ee817c892fe57dda6e3ac07858a088ca4db18e363c2dea8bdb564a22c9bc8faf6c532aaab9b6ba0630f11c15b164a12d3e48f3fd"}, 0x60) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x401, 0x200000) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f00000000c0)=0x4, &(0x7f0000000100)=0x2) getsockopt$nfc_llcp(r1, 0x118, 0x3, &(0x7f0000000200)=""/177, 0x70c2c9) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10088040}, 0x1e1, &(0x7f00000002c0)={&(0x7f0000000380)={0x1c, r3, 0x0, 0x70bd2d, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x13}, 0x1, 0x0, 0x0, 0x80}, 0x4008003) fcntl$dupfd(r1, 0x406, r1) [ 884.428058] binder: 1271:1275 got reply transaction with no transaction stack [ 884.470991] binder: 1271:1280 ioctl 40046207 0 returned -16 [ 884.497788] binder_transaction: 30 callbacks suppressed [ 884.497806] binder: 1271:1275 transaction failed 29201/-71, size 0-0 line 2801 04:48:29 executing program 1: listen(0xffffffffffffffff, 0x0) socketpair(0x40000011, 0xe, 0x4, 0x0) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x205, 0x105002) set_mempolicy(0x4003, &(0x7f0000000140)=0x6, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x44000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x3ff, 0x100000000}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={0x0, 0x7}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000280)={0x0}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x0, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000480)={r3}, &(0x7f00000004c0)=0x8) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getgroups(0x0, &(0x7f0000000280)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000580)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc", 0x16) r5 = accept$alg(r4, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0xbd}], 0x30}], 0x1, 0x0) recvmmsg(r5, &(0x7f0000006240)=[{{0x0, 0x0, &(0x7f0000005040)=[{&(0x7f0000004d80)=""/140, 0x8c}, {&(0x7f0000004fc0)=""/109, 0x6d}], 0x2}}], 0x1, 0x0, &(0x7f0000006440)={0x77359400}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0xa6ba0) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) io_submit(r6, 0x653, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000000000, 0x0, 0x8, 0x1, 0x44030000000000, r1, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xc00}]) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x5c831, 0xffffffffffffffff, 0x0) r7 = accept$packet(0xffffffffffffffff, &(0x7f0000000b80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000bc0)=0x14) ioctl$sock_inet_SIOCGIFDSTADDR(r7, 0x8917, &(0x7f0000000380)={'netdevsim0\x00', {0x2, 0x4e20, @local}}) [ 884.523725] binder_release_work: 32 callbacks suppressed [ 884.523732] binder: undelivered TRANSACTION_ERROR: 29201 04:48:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "0049d13d339c3a83b57716ee817c892fe57dda6e3ac07858a088ca4db18e363c2dea8bdb564a22c9bc8faf6c532aaab9b6ba0630f11c15b164a12d3e48f3fd"}, 0x60) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x401, 0x200000) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f00000000c0)=0x4, &(0x7f0000000100)=0x2) getsockopt$nfc_llcp(r1, 0x118, 0x3, &(0x7f0000000200)=""/177, 0x70c2c9) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10088040}, 0x1e1, &(0x7f00000002c0)={&(0x7f0000000380)={0x1c, r3, 0x0, 0x70bd2d, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x13}, 0x1, 0x0, 0x0, 0x80}, 0x4008003) fcntl$dupfd(r1, 0x406, r1) 04:48:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x400000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f0000000300)={0x8, 0x120, 0xfa00, {0x2, {0x6, 0x3, "cfa1e823d0cf6e803fad036183a2feabb21a09a9fae404cfaa56dd835c7208f8ae43d491457c72e407959b1c9cff387c54d3ce37f52018606e1608c4603396fe29aab75323f849f114f8e5d9654f952b0f3da42994d0675c102abbd0d1f2a7d72188691a42ba39a7b6227c1679d3cd5cee1790faae76b0a45895c323ca99a220f726e01b03beb8b2fd2159fce3e7d886cef7c51cb25165c8da54e5ef38b8671360abb7561574e4ae30ca34564e91b87e292a670d19233cf2dd13df2f0c0899cdaa6413c8aaa218c159e65d01e1f8838b2841c32eabf675603633c033446bf95b091ac46ccdf3bb244b4b83490a669555acac378665f0f0559430c250a662543c", 0x9f, 0x2820, 0x1, 0x10001, 0x1, 0x2, 0x7, 0x1}, r4}}, 0x128) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_MAX_THREADS(r0, 0xc018620b, 0x70a000) io_setup(0x7, &(0x7f0000000080)=0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='memory.events\x00', 0x0, 0x0) io_cancel(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8, 0x10001, r1, &(0x7f00000000c0)="16d3aba97cf04950f0d01d5c75f9a4d3dcd7c43989d6076ff755122fd66f09fd4e109af927d6aaf4fa529af42f67a2ba44c6671b457b985246f35c3313418660e6265446a02185cbc16ee6098036fc8cc543d72b33dd85f7c6737335dff6511fd1458bb748436fd16722ff619c63cb646255fa33fc6e91c479cfd0e225711ff0c15b78fd47e6b0c0e1fd1d8e8991832a67e7189d4040a5b00852624134f0b8f642ddbc88bfd4ae015f0080f5ee", 0xad, 0x3, 0x0, 0x0, r6}, &(0x7f0000000200)) 04:48:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 884.573193] binder: undelivered TRANSACTION_ERROR: 29189 04:48:29 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 884.700223] binder: 1302:1303 transaction failed 29201/-71, size 0-0 line 2816 [ 884.755457] binder: BINDER_SET_CONTEXT_MGR already set [ 884.774376] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 884.774384] binder_alloc: 1302: binder_alloc_buf, no vma 04:48:29 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 884.802048] binder_thread_release: 6 callbacks suppressed [ 884.802059] binder: release 1302:1303 transaction 1637 out, still active 04:48:29 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1a14a045, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000080)={0x1, 'bpq0\x00', 0x3}, 0x18) ioctl$BLKPG(r1, 0x1269, &(0x7f0000001180)={0xfffffffffffffad8, 0x1ff, 0x1000, &(0x7f0000000180)="173d3bc82b4e5250ff18bd77c1fe6027f3d35cfa6726bb99d6f5807ccfada1b5329aef2dd0099d562e6803f7e4288c0c279001f0a95ca4c585ad143bdc807a39b42d286bb86b31fb442a078423df3e2f61ee4d098e95d5d67259f8c496715a916e7a9e064cc7b236197daaa75148e436bf0971c6b0ea6a15236831878c1495a196f219af982f58e71b5f0e55ad85f6529255fdcbcbe1f33f8abc80f59c74bd1f64537f4bb0ed93c663863b3395e40ff2069722657993fd2e7734759c99f73ddccf1185b585436431bda074505e8cc230b994a3f96d78bfc207cc3ec645fea01eb183eee6aa0037f4fd66b01ed57caeba53d5b2056ca9bfad319d8c6190095a5f2e50c7d5c9aac826be2bdd02362390bc74d276e27e4dcb69c9d2e51966d98f5ad56a830153fdeade636f98a173f68dbdb8f152a22af1639939154089c6dceda8bf79f5c9cbfe4294fe3e15279c8838d14f2911d69c82a0884ad6e286ad4e464c49842b40e6a17404e27af2c66ffa84223c10935f603224b418120135cf920b12e2b67fd1fce4ab9e598f628c90a7d8016e8aad3dfbe4b3a2f281f4640259bc7cb783455260fca344e5ed10bd5f75ecf5e0ae17862a3805b1708be3952930a3826de4c190aed1743097bb862607821f754478c2921aa8141917c7c29878582468b63aa0b7028776b0a0e7fdbbc99291e36731e900e6b3e9aeaab72cf345a4b2766e370f99fe399d512422846895c4de87e0142bb55b780bf69215db26f0d598a8ed8a385a0625b8987013c30fec4d95f2305ba56c3082991ef8831b6a98da256b27cc49047cffbdb19070970d3ffc756d09383276d720eb7bca2a53b04e3eba4f0e8af13c25eed29fa0074da4850d753a1fa57f9367a13b4bf963f6c17411b0b7bc2b3d6369fd89531c1b09e65e5b9f33a3e3a6292da1aa304b6dca3f0d0be08d2f96f666a92ddff8ccf906174341891e6b048cd3e836d2159ddeb2a72eb9075a6f7eb4634edc6e1f2f1a3234dd0d67638cdfab717b19e79899c842133a9d23b5685e285bc272902f78251c6f1d6eaab7beb3066c99f5c6006d20dd9a3087b2f536e67c99ed7a794c35e5ebc2d75597b80d919c882dfc67148699be1e60d3a0ad9865cab0f8bfaac89606653ab3b206513c9084a5d2c5e8bf64afd9090d8c6c46761e414f6c67779685a9a1f1e647957941d9d1b5ad3cacee4e1cd128179a5ca4bdd00dfb20a046a9a6a82d89d4dffb2f22856d7089f0589c728521b37e14684aa4a3a7d390517f9eba92056ab702ce69a80fce6854cc96c2695da5cfc24b045eac98ac71276f35a86f619567c745dc2fb6406d92e849b529ceaf80b366898dd2a3974572755d3ab59090a521a1b3dc446a02de149673908632315002c7e92049190bb0a85627b74027fb55d3ba139e913f169b233f751482b16c8a1ec9d9eb623a030666683c39abed7ddd3c101c7c92a44d6da6d1f32be9d7187b14f27bd8049cce214b5aa12cffd00cc0c6a17f49e5255bf8e4590cd9c18f589ede92d71bbc8cdd48862c487588a7616aa39c9f70d4775f1f27035515214eb19ce79598bd04b05173d0ef4b8dd111d38567ecf5213db9e88569742c96d9bf81ce1d5f6c87e8b95adf73954188c8af36950d01130798a64a0fd7552a6f7822d6fc9e45dd6ef536f2134a67117d2733006be4cc38b80d96df0f849212ea00d2c211e3a58295ebbaa87d9281bbe855311c5405c1dbc4ad77222aac13b0a8341887511933516b986fa86547111fc7ada23b17ae5e661cc32dc035de49005803aef23b62de9ba0ce28357c45501f6de17cb784ce5f52f75767c7d7ee9c3a52d78a9f250cf61876eb1159b0bc8340135b040a4d58225ade64e347409d644139c5c71320fb63c435b1434db6ba57e93c51e7acc8bc4c3c8ed9709249e17cf349e2a984fc9a2a4e95a7bbf4f90ca17ca24b073a74743c2c51cb954ddaa0cc565f146bd0f1e53b8ca3baa383997e281ef52ddf24bb82d066bec3793dffb2397d01ed77893fa39a6d597eb7e7997c3eccc0f521c3c7e3e5db56afcf07a7c1871400cc430428827e29dd75dea4da2f24d9bb91a8ff4ce5c2a0b1b77028190783d9575bda53cfd21a292668501ef5bafd934f62c61ef2091c02ba14a83e11ba13a8e2300b470bdaf962c4c95cda325c4e7fa9c764435902a8bbcb570e96c8658e05493c91fc6bea58ed249aeeac394d4cd7efe2672fc1c6bfd25ce1edef6d473014c7458d540d144142a4f87094ef97c41b8261c11de6db0e025675c8df71f6306c6ceebe71cb9196389fc9dd76f9b21eb69e366087c10db7a6e139f4299bcaffcd667a63824f66ef1531ee99b7983541f95530212b9693658472c9159b68f28b02df84857e034e59ec234aa0c1c42cfbaf06a94ee22ddb420a42d1ddd60f9cd154ed0fa7beaa5c7ca2df070142d8960c15e5129fc86c1478a066965e640d4f5cbab27a12771dab5149896b114f9caf490ca107916f60d1e621c2ccb25ff64be46d0b7139c3bc38e78af8f106bb8978cc91cf1531762cd813b2705ba86b5ec46e397f7c8a7526ff853da686ff8c294a21775a7a58e6022dc51c9a9cbd18584dfef40c086ab949f4182b6bcc8a53367f66f7c26980a5026b7a5e05d1b9a57239981d1f3053fc80c577afd07fab4524c1159e4ee8a5423f2be48d8f0690b56596ec708d29d68594b7252e92f293a5e51f0b12296b85b0db71c1ce791535da54fd767bbe1d434127f9579b36b617cc56bfdcc853c6314e3b4f8be8c593ddeaa3401f4491b02d4b7d572ad7b1fdc6d7e2b119749ff54a1b32e789cd6d7455dbe3a5ed6c2951e291aea7a11b5a091af7e3366d51e7929fcef9ee110f0d02a91102d52d4bf91991d012fb3f409f79b44cdb3418a5632c3500a6a2133e3ac8f8ae7d108dcd5d131a5af8ab01f0284eff839a829e2aca277cd65be9a037f516ae1893ac2379d235cd28b91c57ec84eabbb3d256e04e57d3275cc365f7d33f130a9b0d49284828cdb18c7ffcce3f2761abeb01c1b841e48373adff28804306df1573aab3c65edbdfe5112d971809287db2ca02b16edc52f559974c5489820f7fe101ec1533d258b6bf92c51cb365c7eaa925711919f9dc7f3b2a1d36fcae10fe9588c2872c48b61238fce0d1882ab1a20ad69cc1f7be7bf237ef5834fe0b11a62662a2e27f80ee0377998222fcbbbb072bee10249e439d4a7c7824132c14e56fa582e96e384dd66d11a21c52da345aadc46d3efd8433f448fbbeab550681127d4fc3e8ad8806b40aebdf5d2344f2463b0ad1448a2573dffcdb866f714b688786b20dd2f73d50a4dd9e9981ad322aa206664bc7ddb9c58163a52ef99f3e19b8374ab1ffb6c4ebbf9096e394aaf0efc446ce9314dadbf85e5944de6493ae3e9acfcc0ab070fa38be6ef99aad846627c9066b3fbdcc2a20d933c6e83ef3b3b2a6e6950b1801a67ae5bcaea38c657ff44e99d31880530df53cd85bc2fd407bb936808f1c5f0936382a307cbbef94e5cc2dbb43b949d8267a315c557827c45e17304257706d893184e75178cba67e6290fea54c0c81adf5a8eb73b4520a43f076d0f1e280eb879f5d61e08ca4727caf63cafc3cfc42c5378c1307bb4cf2a83a9fc8379867ae5d4116e322937816d52db87fd8543275022128fbfe251dc7e7f0b2679b17ed7732f64ec4c18e892e108ca571a17e95443f4824e344ab988793bd402c4c186820f428b3de1233b82938dfdd936c8325e6175c2718f4913d86a7e92ab8bdf44ca3a1a7380b78b43d896683d78c9a53678c4e9ac45f3a4554834dbc5b3d781effece145fd56a75b7f0596df389d619a6861f84ffd4e0c1971088438bf085834e062a99b35c3ee65dbbecb7fa21ae26b91dd174b1bbb9ddd7ce470d7ecac432fee6d1036015a166d820f40ce8794e30c5a22db65847a41e9c51f30007210e0a63922b47f4d5fab06796fbea8b7607a17539a05807cdd9c0ba9da6f2abf615f85fe836e0eed9f4c049c1d7ad2ec42d30e3429a51cbd091b11ecac14e13f5ea53af614f482102b7298a740c4a2acba93892712157594984139b39d5a247215162467047d8c1f92f4e6c8ea61c817eef1ba5665a5281cfbd9d0df0d30baf15be2306cd36e1d113103d4ef60cb9a2f66c28f39d6c8148635e7fe23aed4ce0b5d3fa8255ec99f3fa1fed4c602b6775f62a4c3e6dda5a6c660fbd5551e43af986fe713991f26e40f8ee5f0ad1cf974fd05d7ec48bb3da2f98f07ccca6e6d091a72e7ec1c02d7500a8ab5388a004b97a1f21882edbb9731103420ffac76c3f3746e2aee245bc8564b4128e4762a9f254e0ce3f8268c2faabc26bb6d03b9ea77df37f096765dd13daaac5958fa3ec03b587ba519cfd7a9e93f4af4c42c617c91032e9a437bbd5a2a040f82e7b76b0fa5dfe4abb2bca3099d6e84dfc5a2ea303b729e9c1475afb272d67424e5ac2f4cbdee6f5112672d3b09a0274e41d9702501904f865969b3a7bb0c3f8f52e6b53be839caaf15a66ef597191057219cd6517d01ca7db0066bcd17d947c4712c333b7a40acdbd4ec65a7ee83834d965c5abff6a4ab7a0ce4da055885d994b3ff8efe214205f30df9b07b4efd031f22765505232cbaf92390ea6276ad7143445531f24496b5c54f796b9c9caf44cf0abbd8bda6d51911186ece009487b790a0044255fc90d60893501dabc6a4585a9aedfb635e2da741c45ad028646daa8b962ccf398d92c2a382748ea9edf9488ad53c6b16ade89caa9486df0daa4356b877d46c2f0426e63af5655723dea445f94707e86b81b6bf8ae4d4712357fd198a59356193e89bedb5f0ae7a302f50737fcec01b5a0c1f4ef45096d53b29a9ed2bea5e53431144645eba820ed064c528507cfefb967a46df05a62a9af105c28ca8fe616079fe389554a5c31be061af1a81770f8758ad8f57d143d96af1c781786a1681be22d7e49665d172890222545fa974c12f49f07c25365fe068ce8c8001d80e8341ef358aef4932f959ffe8ab957066f32afffda2d55eeaae430bdb3eae19960c72501c0979ddf7f51475c7f5828de6be48f2ed6c78e9a1b27602ba54894807b7e66f606304948a7f987222f47577560599d954ff7aaec0844cdeb377af8015d68703b79f001f974f1e101edf645564ed9860a37251d45f512ead6e20cd296f71a60dba8d9ab8b171041be07db8868e131fd873208c832c4e80b8dbdba9cb7a0c8057b387c568c42740bf7a739eb1584cdbe54640dea7d977dc39d473470f08e70ea1755ef291c14a34385f8aa2514be9929bec9cd4a9c954768eb7d5d4002da75b44471ce06a3871147492eecfb94387a7bfb3276befce851a440f61e3b19029fc1782ba2b3adcced5ffe79dd72274e5d5bff1ff07a04f9dc670d82f70069d992ea440aa7eaa4a4f56328e5e8c4575f0cc69f5c78486c1d2fa6cfaa08a368d74bd6935f25f85e3522ec500be73acbf5cbd0a9b1a5d282474e10e209437b9cc87f7de7009c4c9272b21e98ef846b93cee932ed8d1b1188e6650b298d570045aa74394f0797be4247dfcf451c77a68166ad5053b62ce5f12819969888a094fb35e4cac6b35c40ff8baf86db123667f07e6222e3f4f3259eea435eb02d12b1586c57bdf0c2c7bd30d309bbbde196c8e17f0528f5835e9d766326d8b357914fc86ac7d7b37d952c5584384a5de2a55a3c049016864951131000ead3e1d7f1aba1797cab90417852571dd557e0937b15fb08cbf765e62bfd26576c0dbc27445d684d55ed3f78753ac"}) r2 = dup(r0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x660000, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000100)={0x1, 'team_slave_0\x00', 0x2}, 0x18) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000000)={0x2, 0x2000000005}) [ 884.848656] binder_release_work: 8 callbacks suppressed [ 884.848672] binder: undelivered TRANSACTION_COMPLETE [ 884.882060] binder: undelivered TRANSACTION_ERROR: 29201 [ 884.909453] binder: 1302:1311 ioctl 40046207 0 returned -16 [ 884.943564] binder_send_failed_reply: 6 callbacks suppressed [ 884.943572] binder: send failed reply for transaction 1637, target dead [ 884.958557] binder: 1302:1313 transaction failed 29189/-3, size 0-0 line 3035 [ 884.994369] binder: undelivered TRANSACTION_ERROR: 29189 04:48:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:29 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f00000002c0)=""/146) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) bind$isdn_base(r1, &(0x7f0000000040)={0x22, 0x1, 0xa, 0x0, 0x9}, 0x6) [ 885.108614] binder_transaction: 8 callbacks suppressed [ 885.108630] binder: 1326:1327 got reply transaction with bad transaction stack, transaction 1641 has target 1326:0 [ 885.142633] binder: 1326:1327 transaction failed 29201/-71, size 0-0 line 2816 [ 885.183811] binder_alloc_mmap_handler: 8 callbacks suppressed [ 885.183828] binder_alloc: binder_alloc_mmap_handler: 1326 20001000-20004000 already mapped failed -16 [ 885.212807] binder: BINDER_SET_CONTEXT_MGR already set [ 885.219007] binder_alloc: 1326: binder_alloc_buf, no vma [ 885.235570] binder: 1326:1331 ioctl 40046207 0 returned -16 [ 885.299707] binder: 1326:1327 got reply transaction with no transaction stack 04:48:29 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) fadvise64(r0, 0x0, 0x0, 0x4) 04:48:29 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:29 executing program 2: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000640)=""/198) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000500)=ANY=[@ANYRESHEX], 0x12) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x100}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000380)={r2, 0x2}, 0x8) r3 = fcntl$getown(r1, 0x9) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000300)={0x1, 0x3ff}) ptrace$setregs(0xd, r3, 0x3f, &(0x7f0000000240)="4498abe461a47c568fe9dace3f6ecaa90cb453ca672690031e251f515d01da243cdd0adbab42dc00befe0d1df2ed9a486b4e4d08ee00a30fa684f09cc45c7e13d8fc5f8188f5d0af41a0b4f029fdd65840cd28b1bb317206f37c11f9e2bf5e9d4d1729f25046b947be2e35d550f3811c99af1f6564c590bf17714a6fcc301d00d9fa36fdf4f3df8e716939f91401b4339729d4") modify_ldt$read_default(0x2, &(0x7f0000000080)=""/87, 0x57) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f00000003c0)) write$P9_RLOCK(r0, &(0x7f0000000200)={0x8, 0x35, 0x1, 0x3}, 0x8) socket$pptp(0x18, 0x1, 0x2) [ 885.355959] binder: release 1326:1327 transaction 1641 out, still active [ 885.364540] binder: 1326:1334 transaction failed 29189/-3, size 0-0 line 3035 [ 885.379565] binder: undelivered TRANSACTION_COMPLETE [ 885.413734] binder: 1326:1327 transaction failed 29201/-71, size 0-0 line 2801 [ 885.424226] binder: undelivered TRANSACTION_ERROR: 29201 [ 885.467547] binder: undelivered TRANSACTION_ERROR: 29201 [ 885.493166] binder: undelivered TRANSACTION_ERROR: 29189 [ 885.522077] binder: send failed reply for transaction 1641, target dead 04:48:30 executing program 1: listen(0xffffffffffffffff, 0x0) socketpair(0x40000011, 0xe, 0x4, 0x0) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x205, 0x105002) set_mempolicy(0x4003, &(0x7f0000000140)=0x6, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x44000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x3ff, 0x100000000}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={0x0, 0x7}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000280)={0x0}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x0, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000480)={r3}, &(0x7f00000004c0)=0x8) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getgroups(0x0, &(0x7f0000000280)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000580)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc", 0x16) r5 = accept$alg(r4, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0xbd}], 0x30}], 0x1, 0x0) recvmmsg(r5, &(0x7f0000006240)=[{{0x0, 0x0, &(0x7f0000005040)=[{&(0x7f0000004d80)=""/140, 0x8c}, {&(0x7f0000004fc0)=""/109, 0x6d}], 0x2}}], 0x1, 0x0, &(0x7f0000006440)={0x77359400}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0xa6ba0) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) io_submit(r6, 0x653, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000000000, 0x0, 0x8, 0x1, 0x44030000000000, r1, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xc00}]) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x5c831, 0xffffffffffffffff, 0x0) r7 = accept$packet(0xffffffffffffffff, &(0x7f0000000b80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000bc0)=0x14) ioctl$sock_inet_SIOCGIFDSTADDR(r7, 0x8917, &(0x7f0000000380)={'netdevsim0\x00', {0x2, 0x4e20, @local}}) 04:48:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000380)={0x79, 0x0, [0x6]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000001200000002"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x600, 0x0) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000140)=0x80) r4 = dup2(r2, r1) getsockopt$inet_sctp_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000000), &(0x7f00000000c0)=0xb) 04:48:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 885.656948] binder: 1348:1351 got reply transaction with bad transaction stack, transaction 1646 has target 1348:0 [ 885.688762] binder: 1348:1351 transaction failed 29201/-71, size 0-0 line 2816 [ 885.711249] binder_alloc: binder_alloc_mmap_handler: 1348 20001000-20004000 already mapped failed -16 [ 885.739077] binder: BINDER_SET_CONTEXT_MGR already set 04:48:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 885.764077] binder: 1348:1351 ioctl 40046207 0 returned -16 [ 885.799909] binder: send failed reply for transaction 1646 to 1348:1351 04:48:30 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 885.830165] binder: undelivered TRANSACTION_COMPLETE 04:48:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") prctl$PR_SET_MM(0x23, 0xf, &(0x7f0000ffa000/0x3000)=nil) 04:48:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 885.855981] binder: undelivered TRANSACTION_ERROR: 29201 [ 885.883848] binder: undelivered TRANSACTION_ERROR: 29189 [ 886.051217] binder: 1369:1372 got reply transaction with bad transaction stack, transaction 1649 has target 1369:0 04:48:30 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) 04:48:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(0xffffffffffffffff, 0xc0bc5351, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000140)=[0x0, 0x8, 0x0, 0x0]) write$FUSE_OPEN(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000040)={'TPROXY\x00\x00\x00\xf8\xff\xff\xff\xff\xff\xff\xff\x00'}, &(0x7f0000000080)=0x1e) r1 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x40040) bind$isdn(r1, &(0x7f0000000180)={0x22, 0xe65a, 0x0, 0x86d3, 0x9}, 0x6) ioctl(r0, 0xffffffffffffffb7, &(0x7f0000000080)) r2 = socket$unix(0x1, 0x1, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') listen(r2, 0x0) [ 886.157711] binder: 1369:1372 transaction failed 29201/-71, size 0-0 line 2816 [ 886.178663] binder_alloc: binder_alloc_mmap_handler: 1369 20001000-20004000 already mapped failed -16 [ 886.268075] binder: BINDER_SET_CONTEXT_MGR already set [ 886.292664] binder: 1369:1372 ioctl 40046207 0 returned -16 [ 886.327974] binder_alloc: 1369: binder_alloc_buf, no vma 04:48:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:30 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000040), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:30 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) r4 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r4, r4, 0x0, 0x3}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x200000007) write$cgroup_int(r5, &(0x7f0000000000)=0x1, 0xfdef) [ 886.364354] binder: 1369:1383 transaction failed 29189/-3, size 0-0 line 3035 [ 886.382725] binder: send failed reply for transaction 1649 to 1369:1372 [ 886.410830] binder: undelivered TRANSACTION_ERROR: 29189 [ 886.449230] binder: undelivered TRANSACTION_COMPLETE [ 886.619378] device nr0 entered promiscuous mode 04:48:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(0xffffffffffffffff, 0xc0bc5351, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000140)=[0x0, 0x8, 0x0, 0x0]) write$FUSE_OPEN(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000040)={'TPROXY\x00\x00\x00\xf8\xff\xff\xff\xff\xff\xff\xff\x00'}, &(0x7f0000000080)=0x1e) r1 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x40040) bind$isdn(r1, &(0x7f0000000180)={0x22, 0xe65a, 0x0, 0x86d3, 0x9}, 0x6) ioctl(r0, 0xffffffffffffffb7, &(0x7f0000000080)) r2 = socket$unix(0x1, 0x1, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') listen(r2, 0x0) 04:48:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$DRM_IOCTL_VERSION(0xffffffffffffffff, 0xc0406400, &(0x7f0000000240)={0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_xfrm(0x10, 0x3, 0x6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, 0x0}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:48:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:31 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:31 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 886.784826] binder: 1403:1405 got reply transaction with bad transaction stack, transaction 1653 has target 1403:0 [ 886.851144] binder: 1403:1405 transaction failed 29201/-71, size 0-0 line 2816 [ 886.878075] binder_alloc: binder_alloc_mmap_handler: 1403 20001000-20004000 already mapped failed -16 [ 886.908724] binder: BINDER_SET_CONTEXT_MGR already set [ 886.914974] binder: 1403:1405 ioctl 40046207 0 returned -16 04:48:31 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000004e00)=ANY=[], 0xfffffdec) write$binfmt_elf32(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) r2 = gettid() timer_create(0x0, &(0x7f0000000240)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(r3, 0x1, &(0x7f0000000140)={{r4, r5+30000000}, {0x77359400}}, 0x0) tkill(r2, 0x1000000000013) [ 886.968468] binder: release 1403:1405 transaction 1653 out, still active [ 886.978196] binder: undelivered TRANSACTION_COMPLETE 04:48:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 887.017142] binder: send failed reply for transaction 1653, target dead 04:48:31 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:31 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x80440000}, 0xc) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0xfffffffffffffff9, 0x400) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x100000001) getpeername$llc(r2, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f00000000c0)=ANY=[@ANYBLOB="03000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000100)=0x2c) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) [ 887.121814] device nr0 entered promiscuous mode [ 887.140756] binder: 1426:1429 got reply transaction with bad transaction stack, transaction 1656 has target 1426:0 [ 887.218239] binder_alloc: binder_alloc_mmap_handler: 1426 20001000-20004000 already mapped failed -16 [ 887.229706] binder_alloc: 1426: binder_alloc_buf, no vma [ 887.229798] binder: BINDER_SET_CONTEXT_MGR already set 04:48:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000480)={0x79}) getegid() r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r1, 0xc038563b, &(0x7f0000000000)={0x1, 0x0, {0x619, 0x7, 0x2, 0xf8f}}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe1000/0x18000)=nil, 0x0, 0x317, 0x0, 0x0, 0xffffff89) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) ioctl$sock_netdev_private(r1, 0x89f9, &(0x7f0000000040)="65bb4c52461f0a9eccfda51441a8dc8332cbd5540707bdb94fb05f66fe17f6e2f19592c088812beb5fee8f5dcbd3ad52ee64eaef1431aca78f045c34229ff7d6007293361cc6c1d6ce334f615ec68eda1233c463bd792766886b1fb9b03c2cca7a7818266b7ed83ef23059ac251cbbc3984888d33634d9778e223b1d2d425c40bcd21eaa72cf1d1ad43042fd12362037041938c0d0cbe759a2c26e74214b077a3aa4b1a44fde7876aaf7025af5f633209ae88d1d2385b2f1dc1e6170a2ce94d45c69e21455e7ae1bcd1ca9a70001514251f525376c146cf039519cd2f468712c9f8c3ba214679dd4037a7edd7168380ba9e72d7dc0598347c7a4bf646dbc") socket$inet6(0xa, 0x800, 0x8) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000001940)={"a523fb9656eb871ffcd7ffeb51d84e738a55eba841ae487e33cdd957e8a51ce6c924020f0ac3562dd8cdeb31deac16f46da4ac16ee8165bce439eddce671c5b0a1103ea3f86a43cbb78504f6f9c77c2f09dc27632ec6036ee52a87e321e707c0cfe15576c26d52d0334c8d4693e127b3a046a5ed7796c9c5017cfd58ec871ed76369846fea9ebfa2f7f96496abf4ef57ed1ecd930eb9e13396875f01e932804ffe8a34c8fbedd97cdfb3176ec59fbbfd20a6ff17795431c341a35eb0f5f703480a5211cc6a7e2084e4a9b6aedf60b7b8084b00ca2cbed255b4cc4679c967432fea5e95119f9635e94794aab6ef54f290677fa08d0ee2cc8eae468efd02417055d3f3ccc86b629dfb878c4d115c16c75fe352cffa93648cf49577256b5d2faf0634335c97ffff966ae90cbf81250df3613c25d2789c869c9cc95a6e9d364c4c684059c593f9950e66cf81cd9f36d73fade4f0cbb795010364d13ff32c12efd91d0ebb6533700945f2db6113a630bd521eec89a74c46e1733b72d6e4d2ccee3b40f99809a9a4fb5fc2d1c53e1366d455bcbe81893100ab56b2556b55c1a0c5787356b464c3bf7011488e55f587a6d4420d46d69a74ee5bbfbcb0d6cb00aae8c3dfd6dd2e9f76d7a542f20553207b668dce69f1b463ee9166e81bb109f461b8885f15c9e525d72260ccdbd69e3345612158114380b9409ea856cb724faa6ed27ba836b35c10e7c7d43f2fa34f98f16a00f31565e16a213eaf4a7f438c89733ebe6d16328b930fd942bc64d631dd1f2aa1cc2ccdaff2324076c83e1ba4d2a0e40e010c96b42e7a4a76cd7a89ef592b9b3030f62d9fbd565ee5908ab90b42620b61e5d1e08621a31d21003cd12a450461636472fa64a7e1b98778bfb482fb4b4da31b42ee98b10f9c0f4c085d08c37ee2e3a9e4a5aff72a0ab844fcbfa224842c85f6cdfd25829c44760e3859624f891df4824f7d17938ac2dee1412cf3083e1d5ee2d29b63267ccba535409da7bef05d3fa79a3ef037ee609e01ad345ee17f48b5e8510f767de35df4dfb856f7533ad88866c6b01fe345107ba7191a8809e2e014492acf9c4f35cad664198a65c55f884490f4b30b4526324be842c393f336f16bea2bf6c6b917fdb751e12ff689ab4ffa44625a8b2bc1de4e88682abe5ce9d1942792747681ad23c31046d825140987f19a9cf10323c3f50a20f35a6d1dd8ca6758296b4537a0da1a853011b777623c8774b3689897cf9264a7782470847f36a8093f04000000663438ab39d8a777fb3e10cb4a2402a939a98d387087c5ca5fd8fbc4d96ae698b5bb84a0a8484e2b85743e623a033eb5b1889ccfb4b95885bc69d4c1cb819b95e7923e557c9ec9ec10e94d1e1295fc2f256fa095036f6cfc04c414fc57fc72c120614a586089c93741e97a61c46600"}) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) fallocate(r0, 0x50, 0x80, 0x10001) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfe2f) keyctl$read(0xb, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000500)=ANY=[], 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 887.265142] binder: 1426:1429 ioctl 40046207 0 returned -16 [ 887.265161] binder: release 1426:1429 transaction 1656 out, still active [ 887.309928] binder: undelivered TRANSACTION_COMPLETE [ 887.337173] binder: send failed reply for transaction 1656, target dead 04:48:31 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) io_setup(0x1e7, &(0x7f0000000000)=0x0) io_submit(r1, 0x2, &(0x7f0000000100)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x9, 0x6, r0, &(0x7f0000001200)="2b3a397563da9ef3a1b02b0c2c8b5443369e31c7ad4fa78fd8577c935ba7210094c0572a32d5c385b706d50c359ae8e8dcaa225ca458d67505ef63000ece8b44792291af57429f131092798092c2c4ac113abd4f2de2dd0b2b486fa8e31869324f07577c42b1f89a5b61d5b444654490e19e15f0d675aed283269d4bf41de79dba8955ccd870a61191f848380d0c58039aa47d363e24a4dc8838703c4e015d3e75659743645cee53f88fc4c8a163820204005d21888579a5acb41454dd3ae6be28ba52e9091c3dac6ee3e67f7d6e1f57606ab2219a9e4e440c5dcfb362d68a572042a727a5accbc53dd2", 0xea, 0x400, 0x0, 0x2, r0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xf, 0x4, r0, &(0x7f00000013c0)="373de3d98e72d412b0cf75db2c6876342b322c76a02d9c652ae20efe9fa16dace71a4c33d34cd615ae752c62222ac987caa793c45f575ad9c8f38d7b586f4cee3268c381aa2dc68e62e8595ee9d0b2e42b9029fbcf8b32a41ea07fd3f9f73ea9b4383058807fcc40e38402486442409e2d689906b52f98240fd771a2fc3986ec4127f89347a5f887a7d690979262310f5c", 0x91, 0x6, 0x0, 0x3, r0}]) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001480)={{{@in=@dev, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000001300)=0xe8) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001340)={r2, @remote, @broadcast}, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000040), 0x62) write$FUSE_INTERRUPT(r0, &(0x7f0000000180)={0x10, 0xfffffffffffffff5, 0x4}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) inotify_add_watch(r0, &(0x7f00000001c0)='./file0\x00', 0x4000000) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:32 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:32 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 887.505586] binder: 1445:1447 got reply transaction with bad transaction stack, transaction 1660 has target 1445:0 [ 887.518381] kvm: vcpu 0: requested 34784 ns lapic timer period limited to 200000 ns [ 887.593257] binder_alloc: binder_alloc_mmap_handler: 1445 20001000-20004000 already mapped failed -16 [ 887.642605] binder: BINDER_SET_CONTEXT_MGR already set [ 887.663283] binder: 1445:1447 ioctl 40046207 0 returned -16 [ 887.696207] binder_alloc: 1445: binder_alloc_buf, no vma [ 887.720295] kvm: vcpu 0: requested 34784 ns lapic timer period limited to 200000 ns [ 887.729617] binder: release 1445:1447 transaction 1660 out, still active [ 887.738045] binder: undelivered TRANSACTION_COMPLETE [ 887.756513] binder: send failed reply for transaction 1660, target dead 04:48:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:32 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:32 executing program 1: bind$ax25(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) exit_group(0x0) r0 = getpid() wait4(r0, &(0x7f0000000000), 0x20000005, 0x0) r1 = socket$inet(0x2, 0x6, 0x88) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r1, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) close(r1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, &(0x7f0000000080)) [ 887.878383] binder: 1472:1473 got reply transaction with bad transaction stack, transaction 1664 has target 1472:0 [ 887.897548] binder_alloc: binder_alloc_mmap_handler: 1472 20001000-20004000 already mapped failed -16 [ 887.910464] binder: BINDER_SET_CONTEXT_MGR already set [ 887.921418] binder: 1472:1473 ioctl 40046207 0 returned -16 [ 887.929902] binder_alloc: 1472: binder_alloc_buf, no vma [ 887.938279] binder: release 1472:1473 transaction 1664 out, still active [ 887.951268] binder: undelivered TRANSACTION_COMPLETE [ 887.984024] binder: send failed reply for transaction 1664, target dead 04:48:34 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000), 0x5000) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 04:48:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:34 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000440), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="051e0000000c1bb35840969689870000946753f1fa63809d1d96c7bcbf43fc983ab35121f154981f1112f3dd5cdcac", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000934341c138c7f1bf"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x5b, &(0x7f0000000380)={&(0x7f0000000300)={0x7, 0x0, 0x0, {}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "75abc64b7a58a964"}}, 0x48}}, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000001980)) 04:48:34 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) bind(r1, &(0x7f0000000040)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x0, {0x2, 0x4e24, @remote}}, 0xffffffffffffffcd) ioctl$VIDIOC_DV_TIMINGS_CAP(r0, 0xc0905664, &(0x7f0000001200)={0x0, 0x0, [], @raw_data=[0x7, 0x1, 0x4a, 0x40, 0x7ff, 0x4, 0x3f, 0x0, 0x1ff, 0x400, 0x401, 0x80000000, 0x5, 0x20, 0xfffffffffffffff7, 0x0, 0x2, 0xe, 0x5, 0x2, 0x4d, 0x20, 0x3ff, 0x100000001, 0x0, 0x0, 0x5, 0x280, 0x9, 0x2, 0x3, 0x9]}) read$eventfd(r0, &(0x7f0000000000), 0x8) getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f00000000c0)={@dev, 0x0}, &(0x7f0000000100)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000180)={@mcast1, @empty, @local, 0x6, 0x0, 0x101, 0x0, 0x7, 0x800020, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) [ 890.085944] binder: 1488:1491 got reply transaction with bad transaction stack, transaction 1668 has target 1488:0 [ 890.152680] binder_transaction: 6 callbacks suppressed [ 890.152700] binder: 1488:1491 transaction failed 29201/-71, size 0-0 line 2816 04:48:34 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000080)='/dev/snd/seq\x00'}, 0x30) syz_open_procfs(r1, &(0x7f0000000100)='environ\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc08c5334, &(0x7f0000000000)) [ 890.193224] binder_alloc: binder_alloc_mmap_handler: 1488 20001000-20004000 already mapped failed -16 [ 890.209289] binder: BINDER_SET_CONTEXT_MGR already set [ 890.219593] binder: 1488:1491 ioctl 40046207 0 returned -16 [ 890.228603] binder_alloc: 1488: binder_alloc_buf, no vma [ 890.236843] binder: 1488:1503 transaction failed 29189/-3, size 0-0 line 3035 [ 890.245735] binder: 1488:1491 got reply transaction with no transaction stack [ 890.263300] binder: send failed reply for transaction 1668 to 1488:1491 [ 890.271181] binder: 1488:1491 transaction failed 29201/-71, size 0-0 line 2801 [ 890.279805] binder: undelivered TRANSACTION_COMPLETE 04:48:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 890.309894] binder_release_work: 9 callbacks suppressed [ 890.309901] binder: undelivered TRANSACTION_ERROR: 29201 [ 890.333717] binder: undelivered TRANSACTION_ERROR: 29189 [ 890.349904] binder: undelivered TRANSACTION_ERROR: 29201 04:48:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:34 executing program 4: connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$vivid(&(0x7f0000000140)='/dev/video#\x00', 0x2, 0x2) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000000080)={@local}, 0x0) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getresuid(0x0, 0x0, &(0x7f00000002c0)) r3 = geteuid() setresuid(0x0, 0x0, r3) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xe, 0x4, 0x4, 0xa90, 0x100000000000000, 0xffffffffffffffff, 0x0, [0x7]}, 0x2c) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="59cc9ee6"], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f00000003c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x9}}}, 0x30) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x19b, &(0x7f00000bfff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000004cc32723972b014eec6888000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xb8}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 890.357818] binder: undelivered TRANSACTION_ERROR: 29189 [ 890.461274] binder: 1518:1520 got reply transaction with bad transaction stack, transaction 1673 has target 1518:0 [ 890.472106] binder: 1518:1520 transaction failed 29201/-71, size 0-0 line 2816 [ 890.481776] binder_alloc: binder_alloc_mmap_handler: 1518 20001000-20004000 already mapped failed -16 04:48:35 executing program 4: connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_dev$vivid(&(0x7f0000000140)='/dev/video#\x00', 0x2, 0x2) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x32, &(0x7f0000000080)={@local}, 0x0) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getresuid(0x0, 0x0, &(0x7f00000002c0)) r3 = geteuid() setresuid(0x0, 0x0, r3) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000180)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xe, 0x4, 0x4, 0xa90, 0x100000000000000, 0xffffffffffffffff, 0x0, [0x7]}, 0x2c) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="59cc9ee6"], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r2, &(0x7f00000003c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x9}}}, 0x30) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x19b, &(0x7f00000bfff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000004cc32723972b014eec6888000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xb8}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 890.507533] binder: BINDER_SET_CONTEXT_MGR already set 04:48:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 890.537696] binder: 1518:1521 ioctl 40046207 0 returned -16 [ 890.539058] binder_alloc: 1518: binder_alloc_buf, no vma 04:48:35 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 890.582966] binder: release 1518:1520 transaction 1673 out, still active [ 890.584439] binder: 1518:1528 transaction failed 29189/-3, size 0-0 line 3035 [ 890.589995] binder: 1518:1520 got reply transaction with no transaction stack [ 890.608127] binder: undelivered TRANSACTION_COMPLETE [ 890.634234] binder: undelivered TRANSACTION_ERROR: 29201 [ 890.650633] binder: send failed reply for transaction 1673, target dead [ 890.660865] binder: 1518:1520 transaction failed 29201/-71, size 0-0 line 2801 [ 890.673785] binder: undelivered TRANSACTION_ERROR: 29201 04:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 890.679556] binder: undelivered TRANSACTION_ERROR: 29189 04:48:35 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:35 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) r2 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) r3 = fcntl$dupfd(r0, 0x0, r2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r4 = syz_genetlink_get_family_id$fou(&(0x7f00000003c0)='fou\x00') sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="20000000e90cb4f814832dcce7190e1cb6765da31dbc182ed6c5a32855d100bacc5f6cbb8ec6fdb7297137697298cd4cf2f7ebe0206d8bd2758ff1b159b1e185f1c28a0a50077fce1c237df4f2236f31064730b30d5f0df800c6779724080526a49ebccd472741b4c51eeeef6905847814517ba9d77afebfcb29480f5c6c99c1b61bf42f1ed609aa30f584f966fcfdea050430a8fcd92e8acc46be9c6e939e6dc86883b2cc989af770f8b583f90351d8211ecf031279a557dd3ef44ef759fcf547287badc2351976d6b11d6d20b7bec3", @ANYRES16=r4, @ANYBLOB="14022bbd7000fddbdf2502000000040005000800040000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r5 = open(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000002c0), &(0x7f0000000300)=0x4) write$cgroup_subtree(r6, &(0x7f00000000c0)={[{0x2d, 'pids'}]}, 0x6) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000040)={0x18b5, 0xcd, 0x5, 0x42fc}) [ 890.789530] binder: 1542:1543 got reply transaction with bad transaction stack, transaction 1678 has target 1542:0 [ 890.813059] binder: 1542:1543 transaction failed 29201/-71, size 0-0 line 2816 [ 890.846174] binder_alloc: binder_alloc_mmap_handler: 1542 20001000-20004000 already mapped failed -16 [ 890.857280] binder: BINDER_SET_CONTEXT_MGR already set [ 890.863506] binder: 1542:1543 ioctl 40046207 0 returned -16 [ 890.869991] binder_alloc: 1542: binder_alloc_buf, no vma [ 890.877160] binder: 1542:1545 transaction failed 29189/-3, size 0-0 line 3035 04:48:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") setrlimit(0xf, &(0x7f0000becff0)={0x5, 0x84}) 04:48:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:35 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r1, &(0x7f0000000040)=@hci={0x1f, 0x0}, &(0x7f00000000c0)=0x80) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000180)={0xa, 0x9, 0x1000, 0x6}, 0xa) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000100)={@local, r2}, 0x14) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) [ 890.957598] binder: undelivered TRANSACTION_ERROR: 29189 [ 890.979782] binder: send failed reply for transaction 1678 to 1542:1543 04:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 891.032895] binder: undelivered TRANSACTION_COMPLETE 04:48:35 executing program 4: setrlimit(0xf, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, 0x0, &(0x7f0000000300)) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000380)={0x7}, 0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r1) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000500)=""/248) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x5) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x400, 0x80000000, 0xfffffffffffffffe, 0xffffffffffff8001, 0x901, 0x7, 0x0, 0x0, 0x9756, 0x2, 0x93, 0x101, 0xd83a, 0xffff, 0x6, 0x100000001, 0x0, 0x0, 0x3f, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x200, 0x0, 0x400, 0x0, 0xfffffffffffffff8, 0x0, @perf_config_ext={0x80000001, 0x3}, 0x20000, 0x0, 0x0, 0x7, 0x3ff, 0x47, 0x3f}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000400)={0x1, {{0xa, 0x4e24, 0xffffffffffffffff, @mcast1, 0xae}}}, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000a00)) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x8000) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0x20000259}], 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) [ 891.063055] binder: undelivered TRANSACTION_ERROR: 29201 [ 891.102533] binder: undelivered TRANSACTION_ERROR: 29189 [ 891.143789] binder: 1577:1578 got reply transaction with bad transaction stack, transaction 1682 has target 1577:0 04:48:35 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 891.185802] binder: 1577:1578 transaction failed 29201/-71, size 0-0 line 2816 [ 891.200733] binder_alloc: binder_alloc_mmap_handler: 1577 20001000-20004000 already mapped failed -16 04:48:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x24, 0x34, 0x610, 0x0, 0x0, {0x2}, [@generic="ffd38d9b", @nested={0xc, 0x1, [@typed={0x8, 0xf, @ipv4=@multicast1}]}]}, 0x24}}, 0x0) 04:48:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 891.238544] binder: BINDER_SET_CONTEXT_MGR already set [ 891.279469] binder: 1577:1578 ioctl 40046207 0 returned -16 04:48:35 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xf2, 0x40080000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/softnet_stat\x00') ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={&(0x7f0000000380)=[0xffffffffffffff39, 0x80000000000, 0x7f, 0x3], 0x4, 0x2, 0x0, 0x1, 0x4, 0x7, {0x3ff, 0x1, 0x1, 0x10000000000, 0x401, 0x5, 0x4, 0x10000, 0x3, 0xfffffffffffffffe, 0x517, 0x2, 0x3, 0xffffffffffffff00, "80b7baa4cf8251a55835b97101958dd69348aa78367d2ce7d683c13a054a6e8f"}}) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="b942fbeaf025948ab295fe93c32c05abe1677f8decdce67d80dd2c48e17621f0f48c56425df9316905a92515e8f85bc4c644049295c259098bd969704a7acbeccf9c12afa07c299e86e5c9c06df5cc5bca8ce7b46596c08c159e7386d92cfc49cb8eaffc23d92fa9cbf29742fa1d498af352225692fe10a1010a771fe228f9134caeb83f32bfbc66b8c3425c9ccbb9297f1d39b27acb8319b2d132b3ed7ff58e", 0xa0}, {&(0x7f00000002c0)="305d9e70cb4957dd043ecac2300a265625e973948ddba3d7c6db3c8bdd11ddf09ec1fde6622804cb144d288605ca2c8b5528f1b4066503436da445c94241c5977177b7e52f880ceb2ab6c1de2a0c5d58585decfe2a96", 0x56}], 0x2}, 0x1) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4030582a, &(0x7f0000000000)) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, 0x0) [ 891.345785] binder: 1577:1594 got reply transaction with no transaction stack [ 891.346359] binder: send failed reply for transaction 1682 to 1577:1578 [ 891.354190] binder: 1577:1594 transaction failed 29201/-71, size 0-0 line 2801 [ 891.381383] binder: undelivered TRANSACTION_COMPLETE 04:48:35 executing program 2: r0 = socket$inet6(0xa, 0x801, 0x0) r1 = dup(r0) creat(&(0x7f0000000400)='./bus/file0\x00', 0x3) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = dup2(r0, r0) r3 = open(&(0x7f00000000c0)='./bus/file0\x00', 0x141042, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x7ffff, &(0x7f0000000080)={@local, @local, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x21c, 0x0, 0x0, 0x0, 0xf42f, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0xffffff83, 0xa, 0x0, 0x0, 0x0, 0x8906, 0xf0ffffffffffff}}}}}, &(0x7f0000000040)) setsockopt$packet_tx_ring(r4, 0x107, 0x5, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, r2, 0x0, 0x1, &(0x7f0000000140)='\x00', 0xffffffffffffffff}, 0x30) getpgid(r5) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) 04:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:36 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x9, 0x10) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000300)="2e0000002b00812de41ae087185082cf0124b0eba06ec400014100000000001713d7505951dae2043a3a9c000800", 0x2e}], 0x1}, 0x0) [ 891.577239] binder: 1607:1608 got reply transaction with bad transaction stack, transaction 1686 has target 1607:0 [ 891.649738] binder_alloc: binder_alloc_mmap_handler: 1607 20001000-20004000 already mapped failed -16 [ 891.691525] binder: BINDER_SET_CONTEXT_MGR already set [ 891.701875] binder: 1607:1608 ioctl 40046207 0 returned -16 [ 891.714908] binder_alloc: 1607: binder_alloc_buf, no vma [ 891.721879] binder: release 1607:1608 transaction 1686 out, still active 04:48:36 executing program 2: r0 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x1, 0x2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x1, 0x8001, 0x4, 0x20}, 0x14) ioctl$VIDIOC_S_MODULATOR(r0, 0x40445637, &(0x7f0000000080)={0x0, "0e5efa29e38ce49a0529cd6c797041c568f85d38c37895d0dce03340bc8262c5"}) [ 891.741818] binder: undelivered TRANSACTION_COMPLETE [ 891.759560] binder: send failed reply for transaction 1686, target dead 04:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:36 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000040), 0xfffffffffffffc5c) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f0000001200)={0x2, 0x100000001, 0x800, 'queue1\x00', 0x9}) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:36 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 891.916660] binder: 1619:1620 got reply transaction with bad transaction stack, transaction 1690 has target 1619:0 [ 891.938725] binder_alloc: binder_alloc_mmap_handler: 1619 20001000-20004000 already mapped failed -16 04:48:36 executing program 4: setrlimit(0xf, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, 0x0, &(0x7f0000000300)) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000380)={0x7}, 0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r1) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000500)=""/248) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x5) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x400, 0x80000000, 0xfffffffffffffffe, 0xffffffffffff8001, 0x901, 0x7, 0x0, 0x0, 0x9756, 0x2, 0x93, 0x101, 0xd83a, 0xffff, 0x6, 0x100000001, 0x0, 0x0, 0x3f, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x200, 0x0, 0x400, 0x0, 0xfffffffffffffff8, 0x0, @perf_config_ext={0x80000001, 0x3}, 0x20000, 0x0, 0x0, 0x7, 0x3ff, 0x47, 0x3f}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000400)={0x1, {{0xa, 0x4e24, 0xffffffffffffffff, @mcast1, 0xae}}}, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000a00)) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x8000) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0x20000259}], 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) 04:48:36 executing program 2: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000002c0)={0xfffffffffffffffd, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x44, r1, 0x428, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_hsr\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6erspan0\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r2}) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) getpid() fcntl$setown(r2, 0x8, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x30000, &(0x7f0000000100)={&(0x7f0000000000)={0x347, 0x35, 0x829, 0x0, 0x0, {0x2802, 0x1000000}, [@nested={0x18, 0x0, [@typed={0x3b, 0x1, @ipv6=@loopback={0xfeffffff00000000}}]}]}, 0xfd5a}}, 0x0) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r4, 0x770a, 0x0) 04:48:36 executing program 1: ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, &(0x7f0000000280)={0x8, 0x7, 0x802}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) r1 = gettid() r2 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f0000000100)={'syz'}, 0x0, r2) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x20) wait4(0x0, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x92, &(0x7f0000000240)={&(0x7f0000000040)=@getqdisc={0x24, 0x26, 0x30b}, 0x32a}}, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) exit(0x3) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10022000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_getroute={0x1c, 0x1a, 0x1, 0x70bd2b, 0x25dfdbfb, {0x2, 0x14, 0x80, 0x400, 0xff, 0x3, 0xfd, 0x8}}, 0x1c}}, 0x44050) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000200)={0x7, 0x9}) [ 892.025274] binder: BINDER_SET_CONTEXT_MGR already set [ 892.051643] binder: 1619:1620 ioctl 40046207 0 returned -16 [ 892.073237] netlink: 755 bytes leftover after parsing attributes in process `syz-executor.2'. [ 892.106903] net_ratelimit: 2 callbacks suppressed [ 892.109622] netlink: zone id is out of range [ 892.114702] binder_alloc: 1619: binder_alloc_buf, no vma [ 892.138139] netlink: zone id is out of range [ 892.144712] netlink: del zone limit has 8 unknown bytes [ 892.148694] binder: release 1619:1620 transaction 1690 out, still active 04:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 892.158353] netlink: 755 bytes leftover after parsing attributes in process `syz-executor.2'. [ 892.167879] netlink: zone id is out of range [ 892.170228] binder: undelivered TRANSACTION_COMPLETE [ 892.173338] netlink: zone id is out of range [ 892.182798] netlink: zone id is out of range [ 892.188327] netlink: del zone limit has 8 unknown bytes [ 892.202255] binder: send failed reply for transaction 1690, target dead 04:48:36 executing program 2: setrlimit(0xf, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, 0x0, &(0x7f0000000300)) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000380)={0x7}, 0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r1) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000500)=""/248) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x5) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x400, 0x80000000, 0xfffffffffffffffe, 0xffffffffffff8001, 0x901, 0x7, 0x0, 0x0, 0x9756, 0x2, 0x93, 0x101, 0xd83a, 0xffff, 0x6, 0x100000001, 0x0, 0x0, 0x3f, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x200, 0x0, 0x400, 0x0, 0xfffffffffffffff8, 0x0, @perf_config_ext={0x80000001, 0x3}, 0x20000, 0x0, 0x0, 0x7, 0x3ff, 0x47, 0x3f}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000400)={0x1, {{0xa, 0x4e24, 0xffffffffffffffff, @mcast1, 0xae}}}, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000a00)) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x8000) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0x20000259}], 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) 04:48:36 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 892.332954] binder: 1648:1650 got reply transaction with bad transaction stack, transaction 1694 has target 1648:0 [ 892.362354] binder_alloc: binder_alloc_mmap_handler: 1648 20001000-20004000 already mapped failed -16 [ 892.376422] binder_alloc: 1648: binder_alloc_buf, no vma [ 892.380229] binder: BINDER_SET_CONTEXT_MGR already set [ 892.392131] binder: 1648:1650 ioctl 40046207 0 returned -16 [ 892.401878] binder: release 1648:1650 transaction 1694 out, still active [ 892.417442] binder: undelivered TRANSACTION_COMPLETE 04:48:36 executing program 2: setrlimit(0xf, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, 0x0, &(0x7f0000000300)) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000380)={0x7}, 0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r1) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000500)=""/248) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x5) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x400, 0x80000000, 0xfffffffffffffffe, 0xffffffffffff8001, 0x901, 0x7, 0x0, 0x0, 0x9756, 0x2, 0x93, 0x101, 0xd83a, 0xffff, 0x6, 0x100000001, 0x0, 0x0, 0x3f, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x200, 0x0, 0x400, 0x0, 0xfffffffffffffff8, 0x0, @perf_config_ext={0x80000001, 0x3}, 0x20000, 0x0, 0x0, 0x7, 0x3ff, 0x47, 0x3f}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000400)={0x1, {{0xa, 0x4e24, 0xffffffffffffffff, @mcast1, 0xae}}}, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000a00)) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x8000) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0x20000259}], 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) 04:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 892.431559] binder: send failed reply for transaction 1694, target dead 04:48:37 executing program 2: setrlimit(0xf, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, 0x0, &(0x7f0000000300)) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f0000000380)={0x7}, 0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r1) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000500)=""/248) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x5) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2002, 0x0, 0x0, 0x400, 0x80000000, 0xfffffffffffffffe, 0xffffffffffff8001, 0x901, 0x7, 0x0, 0x0, 0x9756, 0x2, 0x93, 0x101, 0xd83a, 0xffff, 0x6, 0x100000001, 0x0, 0x0, 0x3f, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x200, 0x0, 0x400, 0x0, 0xfffffffffffffff8, 0x0, @perf_config_ext={0x80000001, 0x3}, 0x20000, 0x0, 0x0, 0x7, 0x3ff, 0x47, 0x3f}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000400)={0x1, {{0xa, 0x4e24, 0xffffffffffffffff, @mcast1, 0xae}}}, 0x88) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000a00)) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x4, 0x8000) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0x20000259}], 0x1) connect$unix(0xffffffffffffffff, 0x0, 0x0) [ 892.493106] binder: 1660:1664 got reply transaction with bad transaction stack, transaction 1698 has target 1660:0 [ 892.528456] binder_alloc: binder_alloc_mmap_handler: 1660 20001000-20004000 already mapped failed -16 04:48:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:37 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @loopback, @dev}, &(0x7f0000000080)=0xc) setsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000001200)="b91e2730aec40a2d4eb7fb0bfb5fc52c906de0867acee1516ff24f84d9fbaa6479604fbb33badb9cb4ed20247ce02a29cf0b4db074b38e0471cb3c88cb945678c96d4a04266968d3100214da6e217c9c639b833c91742125699cbe891b64458f80096a7309decb91804693712fe390f266bf68f2fdb7d7207f194f3db70f92b7b979068477d5a728e83cc4829812243a3fc19d4082180a51760d97dc2154d49713a4885451834729f2bf5d6ce15e4b", 0xaf) socket$bt_cmtp(0x1f, 0x3, 0x5) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) read$FUSE(r0, &(0x7f0000000200), 0x1000) [ 892.538507] binder: BINDER_SET_CONTEXT_MGR already set [ 892.544155] binder: 1660:1664 ioctl 40046207 0 returned -16 [ 892.550618] binder_alloc: 1660: binder_alloc_buf, no vma [ 892.556827] binder: release 1660:1664 transaction 1698 out, still active [ 892.566142] binder: undelivered TRANSACTION_COMPLETE [ 892.585592] binder: send failed reply for transaction 1698, target dead [ 892.670813] binder: 1670:1674 got reply transaction with bad transaction stack, transaction 1702 has target 1670:0 [ 892.694247] binder_alloc: binder_alloc_mmap_handler: 1670 20001000-20004000 already mapped failed -16 04:48:37 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 892.717062] binder: BINDER_SET_CONTEXT_MGR already set [ 892.728028] binder: 1670:1674 ioctl 40046207 0 returned -16 [ 892.728246] binder_alloc: 1670: binder_alloc_buf, no vma [ 892.740686] binder: release 1670:1674 transaction 1702 out, still active [ 892.748278] binder: 1670:1674 got reply transaction with no transaction stack [ 892.755799] binder: undelivered TRANSACTION_COMPLETE [ 892.762593] binder: send failed reply for transaction 1702, target dead 04:48:37 executing program 4: mkdir(0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) chdir(0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000280)=""/4096) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r1, 0x0) 04:48:37 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:37 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:37 executing program 1: ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, &(0x7f0000000280)={0x8, 0x7, 0x802}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) r1 = gettid() r2 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f0000000100)={'syz'}, 0x0, r2) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x20) wait4(0x0, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x92, &(0x7f0000000240)={&(0x7f0000000040)=@getqdisc={0x24, 0x26, 0x30b}, 0x32a}}, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) exit(0x3) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10022000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_getroute={0x1c, 0x1a, 0x1, 0x70bd2b, 0x25dfdbfb, {0x2, 0x14, 0x80, 0x400, 0xff, 0x3, 0xfd, 0x8}}, 0x1c}}, 0x44050) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000200)={0x7, 0x9}) [ 893.006459] binder: 1683:1687 got reply transaction with bad transaction stack, transaction 1707 has target 1683:0 04:48:37 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 893.065580] binder_alloc: binder_alloc_mmap_handler: 1683 20001000-20004000 already mapped failed -16 [ 893.075375] binder: BINDER_SET_CONTEXT_MGR already set [ 893.080863] binder: 1683:1687 ioctl 40046207 0 returned -16 [ 893.088168] binder_alloc: 1683: binder_alloc_buf, no vma [ 893.095401] binder: release 1683:1687 transaction 1707 out, still active [ 893.104530] binder: undelivered TRANSACTION_COMPLETE [ 893.111414] binder: send failed reply for transaction 1707, target dead 04:48:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:37 executing program 4: mkdir(0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) chdir(0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000280)=""/4096) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r1, 0x0) 04:48:37 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000010ff0), 0x10) recvmmsg(r3, &(0x7f0000000140)=[{{0x0, 0xfece, 0x0, 0x0, 0x0, 0xf5}}], 0x3, 0x0, 0x0) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000000c0)={&(0x7f0000007ff0)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0xfcd8}}, 0x0) sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000001}, 0xc, 0x0}, 0x0) [ 893.251771] binder: 1705:1706 got reply transaction with bad transaction stack, transaction 1711 has target 1705:0 [ 893.268715] binder: BINDER_SET_CONTEXT_MGR already set [ 893.278390] binder: 1705:1706 ioctl 40046207 0 returned -16 [ 893.284879] binder_alloc: 1705: binder_alloc_buf, no vma [ 893.291108] binder: release 1705:1706 transaction 1711 out, still active 04:48:37 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000011c0)={0x0, 0x0, 0x3, 0x0, [], [{0x1, 0x9c, 0x8, 0x4, 0x8, 0x1f}, {0x17800000, 0x9, 0x4, 0x0, 0x20, 0x1}], [[], [], []]}) r1 = socket$isdn_base(0x22, 0x3, 0x0) r2 = dup3(r1, r0, 0x400007fffe) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f00000001c0)=""/4096) [ 893.301825] binder: send failed reply for transaction 1711, target dead 04:48:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:38 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:38 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) read$FUSE(r0, &(0x7f00000013c0), 0x1000) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000040)={0xd, @pix_mp={0x40, 0xfff, 0x77777f5b, 0x0, 0x6430399ededc0dfa, [{0xfff, 0x400}, {0xffff, 0xffffffffffffffc1}, {0x8, 0x200}, {0xe362, 0x8}, {0xd31, 0x410}, {0x9, 0x3}, {0xf2, 0x200}, {0xe0, 0xf3b}], 0xffffffffffffffbb, 0x8001, 0xe, 0x1, 0x4}}) ioctl$SIOCX25SCALLUSERDATA(r0, 0x89e5, &(0x7f0000000180)={0x54, "4668c13f0aa71645f1e966906a307869ec229577e35f82e07083c1288ddd60e337749041aaa857e208df02d47f06e7f490af16a1e87785d8ff6fabf39862e1d97db5b1bafce9fc3cd5ed41aca6f131aaf65bc9996c94fc89f79c361322e3bd3d9cc8ff649dda6bcbfa66987d17e717c9640a64d66432aa6a0551074f5b574285"}) 04:48:38 executing program 4: creat(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x4000000, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x9) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000580)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000680)='/dev/zero\x00', 0x20001, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = creat(&(0x7f0000000540)='./file0\x00', 0x20000010) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000580)=""/169) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)) ioctl$DRM_IOCTL_ADD_MAP(r2, 0xc0286415, &(0x7f0000000640)={&(0x7f0000ffc000/0x4000)=nil, 0x7fff, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil}) syz_genetlink_get_family_id$tipc(&(0x7f0000000940)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000800)={&(0x7f0000000a80)=ANY=[@ANYBLOB="010028bd7000fedbdf25040000000000000009410000004c001800000002657468000000000000000000000000000000000000000000000000000000000000060000000000000000000000f490000000800000800000000000000000000000000000ce06eed0a17a7a39254c7fac5905c77c114ea6309430e21c0ce87c194641ece8618d218d04f30145781abf60eeb03975a46eec5cf1894568597a9c18de4c843657454334586dcdd117f8514f191fc0633c6821ce35362f92f8b46752aa24eb93c527e779b973f4b726c75628c92c3695109b050ecfcb1ec9f61b9f107cc98e41c3eaf43c8cdc097d53acb90ad8609ea6170955f823855c0181bac8b92f4c9eca85838eed02b38577852a2b665ab4eb0d66c2171e3c962e17f2c577b5a333e670e7a7e58c9068fa85c9832982ed56fdddc4"], 0x1}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_score\x00') preadv(r3, &(0x7f0000000480), 0x1000000000000237, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x5) write$P9_RREADDIR(r3, &(0x7f0000000880)=ANY=[@ANYBLOB="836e0b00003d199545d756e80736db7de74e9f000018d263a136000000000000e6ffffff00000000"], 0x28) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000300)) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f0000000400)={0x4000000000000264, &(0x7f0000000a40)=[0x0]}) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000740)='/dev/zero\x00', 0x21a600, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000004c0)={&(0x7f0000000480)=[0x9d2, 0x2, 0x4, 0xb73], 0x4, 0x2, 0x7, 0x3ff, 0x7, 0x7, {0x2e5, 0x4, 0x3, 0x6, 0x10001, 0x7, 0x5, 0x4, 0x0, 0x5, 0x1, 0x4, 0x3f, 0x9, "12cb7635b3a4238d11e4a9920a1d2226093959fa04fb4ae58a851192d2e5da50"}}) sendmsg$TIPC_NL_LINK_SET(r4, 0x0, 0x90) bind$bt_sco(r4, &(0x7f0000000040), 0x8) 04:48:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x3, 0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB='#! ./file0 ppp0(proc#vboxnet'], 0x1c) syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x9, 0x400) write$binfmt_script(r0, &(0x7f0000000000)={'#! ', './file0', [], 0xa, "bcd254f02e0eadcd428200e7c1783289f501d43eb9e0ef676ffa6c184e4e6e2a0dab3a24e8fc5a04ad"}, 0x34) [ 893.523711] binder: BINDER_SET_CONTEXT_MGR already set [ 893.547802] binder: 1718:1721 ioctl 40046207 0 returned -16 [ 893.548772] binder: send failed reply for transaction 1715 to 1718:1721 [ 893.748871] device nr0 entered promiscuous mode 04:48:38 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x02roup.stap\x00', 0x2761, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000000)={r0, &(0x7f0000000140)}, 0xfffffffffffffc5d) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)=ANY=[@ANYBLOB="00ffffffff"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0c0583b, 0x20000001) 04:48:38 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = socket$inet(0x2, 0x80001, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000280)=0x1, 0x4) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x5, @local, 0x4425800000}], 0x1c) 04:48:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:38 executing program 4: creat(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x4000000, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x9) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000580)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000680)='/dev/zero\x00', 0x20001, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = creat(&(0x7f0000000540)='./file0\x00', 0x20000010) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000580)=""/169) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)) ioctl$DRM_IOCTL_ADD_MAP(r2, 0xc0286415, &(0x7f0000000640)={&(0x7f0000ffc000/0x4000)=nil, 0x7fff, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil}) syz_genetlink_get_family_id$tipc(&(0x7f0000000940)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000800)={&(0x7f0000000a80)=ANY=[@ANYBLOB="010028bd7000fedbdf25040000000000000009410000004c001800000002657468000000000000000000000000000000000000000000000000000000000000060000000000000000000000f490000000800000800000000000000000000000000000ce06eed0a17a7a39254c7fac5905c77c114ea6309430e21c0ce87c194641ece8618d218d04f30145781abf60eeb03975a46eec5cf1894568597a9c18de4c843657454334586dcdd117f8514f191fc0633c6821ce35362f92f8b46752aa24eb93c527e779b973f4b726c75628c92c3695109b050ecfcb1ec9f61b9f107cc98e41c3eaf43c8cdc097d53acb90ad8609ea6170955f823855c0181bac8b92f4c9eca85838eed02b38577852a2b665ab4eb0d66c2171e3c962e17f2c577b5a333e670e7a7e58c9068fa85c9832982ed56fdddc4"], 0x1}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_score\x00') preadv(r3, &(0x7f0000000480), 0x1000000000000237, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x5) write$P9_RREADDIR(r3, &(0x7f0000000880)=ANY=[@ANYBLOB="836e0b00003d199545d756e80736db7de74e9f000018d263a136000000000000e6ffffff00000000"], 0x28) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000300)) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f0000000400)={0x4000000000000264, &(0x7f0000000a40)=[0x0]}) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') openat$zero(0xffffffffffffff9c, &(0x7f0000000740)='/dev/zero\x00', 0x21a600, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000004c0)={&(0x7f0000000480)=[0x9d2, 0x2, 0x4, 0xb73], 0x4, 0x2, 0x7, 0x3ff, 0x7, 0x7, {0x2e5, 0x4, 0x3, 0x6, 0x10001, 0x7, 0x5, 0x4, 0x0, 0x5, 0x1, 0x4, 0x3f, 0x9, "12cb7635b3a4238d11e4a9920a1d2226093959fa04fb4ae58a851192d2e5da50"}}) sendmsg$TIPC_NL_LINK_SET(r4, 0x0, 0x90) bind$bt_sco(r4, &(0x7f0000000040), 0x8) [ 893.915913] binder: BINDER_SET_CONTEXT_MGR already set [ 893.921278] binder: 1742:1747 ioctl 40046207 0 returned -16 04:48:38 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x2d, 'memory'}, {0x2f, 'rdma'}, {0x2f, 'cpu'}, {0x2d, 'cpu'}, {0x2d, 'cpu'}]}, 0x1d) fcntl$getflags(r0, 0x401) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x7) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f0000000080)={0x997, 0x1, 0x1}) r1 = shmget(0x1, 0x1000, 0x1, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000100)=""/67) ioctl$sock_netrom_SIOCDELRT(r0, 0x890c, &(0x7f0000000180)={0x1, @bcast, @rose={'rose', 0x0}, 0x1e, 'syz1\x00', @bcast, 0x0, 0x8, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xf4, r2, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xc0}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7e}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1e89}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x5}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x884) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000440)={0x1, &(0x7f0000000400)=[{0xffffffff, 0x401, 0x0, 0x800}]}) sendto$inet6(r0, &(0x7f0000000480)="5c8ab91006f5d38f6bef54fc340a167fc4cee6f344609be6b3311dfd32bc2b6391d4e1d7691c1362d377e1a5865100257a1c79e44fd078f64640a5b66cbde5b9cdf9a5e91776b54ff86d95482e0780b988318095cc30b058bd92f93395fb6c502b61df657630602ef6b7a9129cb5c2c386f3917e13cecbff29e6dd1fcae732c1d4eb1dc8db57754980e2e1f8970e4a6a1a537bd8f044f8f16fc720d8ceb991ac8c7ace1c5b115e0a9c77e14079b4e4dd0f2a3921e395c3d1c377913cf237db012681d4b3a7f613ea34a5bf0c5a7d9cfa0486f2cbad8bb1a44c57cb46885d75a96e4969d21a914bc8e17bc7a2c9bdd9a7b3", 0xf1, 0x1, &(0x7f0000000580)={0xa, 0x4e22, 0x400, @loopback, 0x6}, 0x1c) ppoll(&(0x7f00000005c0)=[{r0, 0x1}, {r0, 0x20}, {r0}, {r0, 0x4000}, {r0, 0x1}, {r0, 0x2001}, {r0, 0x2108}], 0x7, &(0x7f0000000600)={0x0, 0x1c9c380}, &(0x7f0000000640)={0x7}, 0x8) readahead(r0, 0x7ff, 0x7f) fcntl$notify(r0, 0x402, 0x10) r3 = getpgrp(0xffffffffffffffff) process_vm_writev(r3, &(0x7f0000000840)=[{&(0x7f0000000680)=""/52, 0x34}, {&(0x7f00000006c0)=""/174, 0xae}, {&(0x7f0000000780)=""/39, 0x27}, {&(0x7f00000007c0)=""/78, 0x4e}], 0x4, &(0x7f0000000a00)=[{&(0x7f0000000880)=""/176, 0xb0}, {&(0x7f0000000940)=""/137, 0x89}], 0x2, 0x0) ioctl$KVM_SET_PIT2(r0, 0x4070aea0, &(0x7f0000000a40)={[{0x7, 0x4080, 0x3c, 0x800, 0x1f, 0x401, 0x3, 0x8, 0x3, 0x0, 0x9, 0x9, 0x4}, {0x6, 0x6, 0x40, 0x0, 0x6, 0x5, 0x6, 0x8, 0x100000001, 0x5, 0x7fff, 0x2, 0x1}, {0x2, 0x1, 0x8000, 0x3b3, 0x1ff, 0x1, 0x9, 0x2142, 0xffff, 0xfffffffffffffffc, 0x7, 0xffffffffffffff00}], 0x3ff}) r4 = request_key(&(0x7f0000000ac0)='rxrpc_s\x00', &(0x7f0000000b00)={'syz', 0x0}, &(0x7f0000000b40)='lblcr\x00', 0xfffffffffffffffc) keyctl$set_timeout(0xf, r4, 0xfff) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000b80)=0x4000, 0x4) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000bc0)) request_key(&(0x7f0000000c00)='rxrpc_s\x00', &(0x7f0000000c40)={'syz', 0x3}, &(0x7f0000000c80)='syz1\x00', r4) utimensat(r0, &(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)={{0x0, 0x2710}, {0x77359400}}, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000d40)) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x29020}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x4c, r2, 0xa01, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10000}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7f}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xcf6d}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x11}, 0x40005) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000ec0)={0x6, 0x8, 0x7, 0x8000}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000f00)) bind$pptp(r0, &(0x7f0000000f40)={0x18, 0x2, {0x3, @empty}}, 0x1e) 04:48:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 893.972577] binder: send failed reply for transaction 1719 to 1742:1747 04:48:38 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$rds(0x15, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x4011, r1, 0x0) munmap(&(0x7f00001c0000/0x2000)=nil, 0x2000) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") r3 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x4}) r4 = dup2(r3, r3) prctl$PR_GET_FPEXC(0xb, &(0x7f00000001c0)) setsockopt$inet6_tcp_int(r4, 0x6, 0x22, &(0x7f0000000300)=0x1, 0x4) r5 = epoll_create(0x20) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000400)={0x40000000}) ioctl$RTC_ALM_SET(r4, 0x40247007, &(0x7f0000000140)={0x34, 0x24, 0x9, 0x12, 0xb, 0x8, 0x5, 0x161}) getsockopt$sock_int(r2, 0x1, 0x4, &(0x7f0000000180), &(0x7f0000000200)=0xffffff7b) getsockopt$EBT_SO_GET_ENTRIES(r4, 0x0, 0x81, &(0x7f0000000540)={'filter\x00', 0x0, 0x4, 0x4c, [], 0x6, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}], &(0x7f00000004c0)=""/76}, &(0x7f00000005c0)=0x78) mq_timedsend(r3, &(0x7f0000000040), 0x0, 0x0, 0x0) mq_timedsend(r3, &(0x7f0000000240)="3440792164e3b31be80c2f5094ac7a2951b0244e746a053d411f9adb4f5c273e65367b9b89f4d34796661cd7635a857e1aaa3f1c174ff3528fe3a20ae6eb095aceb259f797959bc9aa878cb271b4edefc1419c87f1f0f35f93744d16846d8c213e3810da0c40f9187510433502e2ab5fa3d5bd9433c5f1662dfb871d25c64c7e30f38a3a96a5259ffd57830695a04dd2d5e7a9efb19633dcbb8a5fe6f699a5291a0f7ccdfa994246b67ae021523da1b545f61e5c67c7a8f2b0d48428", 0xbc, 0x5, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r4, 0xae44, 0x80000001) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000380)=0x0) mq_notify(r3, &(0x7f00000003c0)={0x0, 0xe, 0x4, @tid=r6}) ioctl$int_out(r4, 0xfffffffffffffffc, &(0x7f00000006c0)) futex(&(0x7f0000000180), 0x8c, 0x1, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) 04:48:38 executing program 4: futex(&(0x7f000000cffc)=0x2, 0x9, 0x4, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040), 0x1) futex(&(0x7f000000cffc), 0xa, 0x0, &(0x7f00006f7000)={0xfffffffffffffffc, 0x100000000000000}, &(0x7f00000000c0), 0x20) [ 894.116397] binder: BINDER_SET_CONTEXT_MGR already set [ 894.130825] binder: 1758:1761 ioctl 40046207 0 returned -16 04:48:38 executing program 2: r0 = socket(0xa, 0x5, 0x2) bind$rds(r0, &(0x7f00000000c0)={0x2, 0x1, @remote}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$rds(r0, &(0x7f0000000040)={&(0x7f0000000300)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000340)=""/112, 0x70}], 0x1}, 0x0) [ 894.159328] binder: send failed reply for transaction 1723 to 1758:1761 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:39 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:39 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() write$FUSE_CREATE_OPEN(r0, &(0x7f0000001200)={0xa0, 0x0, 0x6, {{0x5, 0x1, 0xfffffffffffffff9, 0x1, 0x7fff, 0x74e7, {0x5, 0x0, 0x8, 0x1, 0x6, 0xffffffffffffff7f, 0x9, 0x97ad, 0x3ff, 0x8, 0xcbd8, r1, r2, 0x7, 0x1000}}, {0x0, 0x7}}}, 0xa0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:39 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:39 executing program 1: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x28) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe9\xdc\x00', 0x200085}) socketpair(0x0, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1000007, 0x0, &(0x7f00000004c0)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x28, &(0x7f00000005c0)}, 0x10) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x2, r0, 0x2) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000500)={0xa, &(0x7f0000000440)=[{0x4, 0xfffffffffffffff9, 0x0, 0x7}, {0x9, 0x1ff, 0x1, 0x6}, {0x7f, 0x8001, 0x1, 0x120000000000}, {0xdce, 0x1, 0x4, 0x3ff}, {0x7, 0x0, 0x4, 0x100000001}, {0x401, 0x2, 0x1c, 0x4}, {0xa2, 0x9, 0x8, 0x7ff}, {0x8, 0xfff, 0x3000000000, 0x5}, {0x100000001, 0x75, 0x5, 0x1f}, {0x4, 0x4, 0x9}]}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000380)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000400)=0x14) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x3, 0x12) socketpair(0x0, 0x0, 0x1000, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000600)='mem\x00\x00\x00\x00\x00\xb2\xf2\x00\x00\x00\x00\x00\x00v1\xa9\xd2I\x8c\xba\x9aUd\xb0\x89\x17\xc4\xfbCQ\xb9d;\xc4\xb8M\xa8\x15\xcdt\x91\xca\x1e%\x9b\xc1\x9d\xef\x85\xecu\x94\xe2U j\xcf;;\x1e\xb6\xa1\xbb\xe3?o\xdd]O\x85\xcd\f\x8eH,\xbaK\xb74\xf4kQwy\x975\xd6\xb5mx\x06\x1c6\xe8Q\xdbr\x1f\xc0\xcc\xdd\xac\xed\xc7D3Wc\xcb\xb4g$\x83V', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup(r2, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0) gettid() r4 = openat$cgroup_ro(r3, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={r3, 0x6, 0x1, 0x8001, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x20) openat$cgroup_procs(r3, &(0x7f0000000340)='tasks\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) write$P9_RLCREATE(r4, &(0x7f0000000040)={0x18, 0xf, 0x2, {{0x80, 0x1}, 0x40}}, 0x18) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, 0x0, 0x26) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x20032600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) 04:48:39 executing program 2: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r2, 0x4, 0x40400) write$FUSE_WRITE(r2, &(0x7f0000000080)={0x18}, 0x18) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000240)={0x5, {{0xa, 0x4e23, 0x7, @empty, 0xf0b}}}, 0x88) fcntl$setstatus(r1, 0x4, 0x6100) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x33fe00) [ 894.520492] binder: BINDER_SET_CONTEXT_MGR already set [ 894.562683] binder: release 1783:1786 transaction 1727 out, still active [ 894.570167] binder: 1783:1786 ioctl 40046207 0 returned -16 [ 894.578413] binder: send failed reply for transaction 1727, target dead 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:39 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x181403, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000200)=0x9) r1 = socket$kcm(0x10, 0x2, 0x10) mount$9p_rdma(&(0x7f0000000340)='127.0.0.1\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x100000, &(0x7f0000000400)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@common=@uname={'uname', 0x3d, '#]\xa1user'}}, {@sq={'sq', 0x3d, 0x400}}, {@rq={'rq', 0x3d, 0x9}}, {@timeout={'timeout', 0x3d, 0x8}}, {@common=@noextend='noextend'}], [{@fsname={'fsname', 0x3d, '/dev/vga_arbiter\x00'}}, {@dont_measure='dont_measure'}, {@seclabel='seclabel'}]}}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x7}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000140)={r3, 0xfffffffffffffff7, 0x30, 0x4, 0x40}, &(0x7f0000000180)=0x18) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="2e0000001800810f622fffe5221ed4c41f606b481f000b000000d41266fb120009000e00037363f6ab14565560b3", 0x2e}], 0x1}, 0x0) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f00000002c0)=0x10001) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000300)=0x7) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000004c0)=0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000500)=0x81) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) [ 894.785274] binder: BINDER_SET_CONTEXT_MGR already set 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 894.813730] binder: release 1808:1810 transaction 1731 out, still active [ 894.821597] binder: 1808:1810 ioctl 40046207 0 returned -16 [ 894.828875] binder: send failed reply for transaction 1731, target dead 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 894.923019] binder: BINDER_SET_CONTEXT_MGR already set [ 894.928799] binder: 1815:1816 ioctl 40046207 0 returned -16 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 895.024390] binder: BINDER_SET_CONTEXT_MGR already set [ 895.041341] binder: 1818:1819 ioctl 40046207 0 returned -16 [ 895.170374] binder: BINDER_SET_CONTEXT_MGR already set [ 895.180469] binder_transaction: 30 callbacks suppressed [ 895.180486] binder: 1821:1823 transaction failed 29189/-3, size 0-0 line 3035 [ 895.199846] device nr0 entered promiscuous mode [ 895.200416] binder: 1821:1822 ioctl 40046207 0 returned -16 04:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 895.326704] binder: 1824:1825 transaction failed 29201/-71, size 0-0 line 2816 [ 895.351506] binder_alloc_mmap_handler: 9 callbacks suppressed [ 895.351527] binder_alloc: binder_alloc_mmap_handler: 1824 20001000-20004000 already mapped failed -16 [ 895.388929] device nr0 entered promiscuous mode [ 895.394076] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 895.394085] binder_alloc: 1824: binder_alloc_buf, no vma [ 895.403083] binder: BINDER_SET_CONTEXT_MGR already set [ 895.408292] binder: 1824:1826 transaction failed 29189/-3, size 0-0 line 3035 [ 895.417849] binder: 1824:1825 ioctl 40046207 0 returned -16 [ 895.418445] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.2'. [ 895.433795] binder_release_work: 9 callbacks suppressed 04:48:39 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x1) [ 895.433801] binder: undelivered TRANSACTION_COMPLETE [ 895.445051] binder_release_work: 37 callbacks suppressed [ 895.445057] binder: undelivered TRANSACTION_ERROR: 29201 [ 895.458291] binder: undelivered TRANSACTION_ERROR: 29189 [ 895.621441] audit: type=1800 audit(1551847720.151:378): pid=1793 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.1" name="memory.events" dev="sda1" ino=17507 res=0 [ 895.690501] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.2'. 04:48:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:40 executing program 1: mkdir(&(0x7f0000000700)='./file1\x00', 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c6531dd6ebb709594212d622569c7fed9a9615ede171914facb07e7f2ed79a46303d198d746e0d66be304eb5d6d185496758b560dc2d75a09b2662ee3d5ef9c8cce8031c7db676e464c072e7c6f2619eec4ab006d2b6190f5b4b34973638b5f3c58de9a96fba7ae020dafa0580dad505a843068725b4da73684869710a8bca480945a8f2a209c4e172058685958d22c573fce19aac23264fbd18e15"]) socket$bt_rfcomm(0x1f, 0x3, 0x3) chdir(&(0x7f00000003c0)='./file0\x00') utime(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0x69a165e0, 0x8fdd}) r0 = open(&(0x7f0000000080)='./bus\x00', 0x1fe, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0xc0189436, &(0x7f0000000100)=0x2) 04:48:40 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:40 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:40 executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={r1, @in={{0x2, 0x0, @local}}}, &(0x7f00000002c0)=0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @remote}}}}, &(0x7f0000000000)=0xb0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000040)={r3}, 0x8) [ 895.876431] binder_transaction: 9 callbacks suppressed [ 895.876446] binder: 1836:1839 got reply transaction with bad transaction stack, transaction 1751 has target 1836:0 [ 895.896987] overlayfs: missing 'workdir' [ 895.931414] binder: 1836:1839 transaction failed 29201/-71, size 0-0 line 2816 [ 895.954565] binder_alloc: binder_alloc_mmap_handler: 1836 20001000-20004000 already mapped failed -16 04:48:40 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[]}, 0x1, 0x0, 0x0, 0x90}, 0xfffffffffffffffd) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net\x00') r2 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r3 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f00000000c0)) listen(r2, 0x6) setsockopt(r3, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @rand_addr=0x7f}, 0x1) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000440)={'bcsh0\x00', &(0x7f00000002c0)=ANY=[]}) r4 = accept(r2, 0x0, &(0x7f0000000080)=0xfe0f) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x9) sendmsg(r3, &(0x7f0000000540)={&(0x7f0000000240)=@ethernet={0x1, @remote}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000380)="e7071e4ef905ca0bb8c5ba1d3ea7fc1ff6741a8e303b7488f38c2063c79fd8fd89e709558b0aeff7591d3dead88165494d0844c721d57f9f76ca3eba097497088fe742f126130cde03eba53f45cb6d332ab819c553f67ed9a6ee9751f405e1c5868ce97d53e491627d860562ae2355d090269e58af253cc94e185e9a0b21fbb741e3f2495e", 0x85}, {&(0x7f0000000480)="3fb338604a5a7211cd941c8a7a00549b8e3c8d518a97932b04490592d57bd53ef112dd9716103073714ef7cd8989b381f301347dbc4f2e23fa4520f2159f1eabd9c1808a64b2fe897f3f39a9dab8118097700e3817abcb6a605e6b3085e20c268ba60d32c9a606af11a1d2179af9b721d5e1f841b7549b66347ac6e91f813cd5bb08d4e8aee68b91655d71f68888c043176d4c6395d952190ca80d5649b5c095428849cbaf84bd04d755d5397c226a1b4fd8219bad9dda442a7a6d44f60b", 0xbe}, {&(0x7f00000002c0)="620ad34f891130976fe13c3e49f07b9a74813a61732d929cf2b7f36fb5545df0bf03911cfbecd4b200304c81", 0x2c}], 0x3, &(0x7f00000005c0)=[{0x90, 0x10f, 0x6, "35ce3b7b498b2573684d724fdf8d307f7f17df4cb09aa7227ead5288ee81f3ad0b4f2500c2c6f0cc83063ee1068e8fa941eab4156b3a98c1e0a4c6b189811f9e5151b9f225dc41a96a0242e63fccb7e9a087702f48cb751097abbd1a57e1516c90e8a8d1bb42c9d50a0aa6c18f837d9f04b1a398e3e56c1b6280fd"}, {0xb0, 0x6, 0x1000, "07e5127b6efd690c8f5a90525ce2f7390f84340bc5460afd318b3c40c4ecd8ee85d0910b7ce3daafb8e0287870727400b3f18e6ef4c65f9e59a07a2449874c974db05ab3e163c8b0e13b1aee9e2b4124a024ce2a1f0ff838b5bddb420955a9415591c0e15d922406b781e72fe43d48e91123ca31f4f876bbbc55bc57711cd686e64836f3abfb5cbb82709c0a4ddaf213c9df7cdce57adfc7cf21a5"}, {0x98, 0x107, 0x6, "b3a79ab90101cdfea6b05e41c088e7036793780cfd267b1792f23ffa6f04fa9641b020784e768e83403d3adcb48cfdf92722be0048bb712e6ffc03d65bf21ecee7ebfddce6903d4460f7d01b5fa19dd2c5d9880f757f87e289f6c3033273b1701ac4425e121c700f988ecf84a161aa92f7af2c826f2f7008bcb9ba9ae8e7094fc54936db65"}, {0xf8, 0x3a, 0x8000, "44381ae8650b8597fd1a0de6ba3474a4d80170703b74dc6a5d2d8f8f67ae4e47984377cb5a9c2a73e64af989d3b5b5b17455a9ac4663024c6c168db9279a33769fcc140dcb9def7a7fd133dcd24feef9d0cb91f6d2dec18c6cafa781f5d3cdf025d728c667a7578906541e9d2f05ed15114ea80c60ef839f58c41d7a48db77ac22a65e8e29b6562aef66b3ef5ebc75bbb668c3c48e22a4e4c0f04fb0412213add4ea2b554689f2d70e65b0a32927dcdc8757a13d18270721c9161f8283ad7a0c50db99082b0b91ff0b50c453219d82a4615482caf92995f31d22b7a4a8f8243bf1396394b0cc0e"}, {0x100, 0x103, 0x2, "5fae99cd0adf5fb9d331ca5246a501613117b5c7c40dc70d874d1e06c88efe666ac1d81e9909a3687d69367067b7ddebee688b032ec91869056512a20bd6abb754289d071db77f22adf6cf2d9599fbbfaea6e0e6ed0b4fdb3af1e71fc4a37d0d2657ac3d863c0f647a33c2c14bc6154e97296c0b1a1b660d24ba600134d63796a1071243b505d299aea779edc74f14e64ec70c834e69442ce0ae56dd5ca56e9cb3da2746bd0df49f1300897e2053b5ec7773bd7f1cff3f7b6aa63886a3ed1d7068565ac7609463e4ebd8452d800ea2bba3567847d03ce556be09fc87cd9e332eb4eb949b0af90a38b0"}, {0x90, 0x1ff, 0x0, "f0754028e55c1d26a8a38f66eb12b1b10b3e4f4ed326b7ecc684de6f0b1dafe1887b0eceb6d70825446474e94d2ff39c580151270558687da86561c340f3d14d9e21eb2d5e406d68e31928f7b030c79d1f9fd8b1f7d5e9b404b569a36781aa0c378ebf3bdc6791b8159ee8c109e58245db3f50d32436afcf5c9b8bc2464040"}, {0x1010, 0x13b, 0xd03, "7ff785c43ab449c8b0831ecfd918d26cdfe079b9e4a7304ca27c00893bf77352e751b5b0426e677d788f1c0d68c7e8f2e3ac87747046dd5bcd0f4c85b808698f5edd8bac2b12272e5971dd4347911dc26eb81e6a390a7574326e24b3094c63d93653dc3d1bdc834563454a55d41279bd526023f99e6358f04152c45752fa9eefa295590018350d5e48bc5064501668f83bfd165db484c9e013a36165c6ad5bc7098f9cd7e4d65a8cd3bf70c5c4e6381ea7ea015c78c9ab891a2a0ac218c2bdca763314084f15e516610854193113c477692d35c38c2f1070984c9ec852004eb5ec9648936da7b9d75e16001ad8bfac4653a34cd820423d775e5b02f6831e5fda1aec745077b4f88134d4aa5956db0bc87098608b294d56549f5c3b72f77620f0245f0226b0b4d5c5e59d3cae2f1cde605e372cf0a2298d2c21f59d436415046e2ef31102a832082822e25ee4ae241484abc4eab0668b135c0490077e4b59d4d2c74152cc11b2f73cc34754727b16d0b1427b7fbceb71b9dfebd1e1fe2ffc5936cb460037fa28e17943f63e3cca107abaeee210c3a751bbb14b662cb8baabddc88d9ee20236f9b14aefb55e05bc3ff52c04eee65be0e15e282a06ed25b059814218b222b1c50a4f8892bb15419c7942ae3fb75bf9656c3c8eb9f06e402ce3c5cfb6b97b09e9431bd7f576bbaae602e1d630fa64ff6b75cdfe3bd3004d49cc5b0548a4ca523089bfe5ddbf1f42e9546bfdfb0619d291e41ddc9b5ccb5b8a1d782a67494a586113025b0a08ffa2f3a282587fe39adf8e416cea64ce5f4594b162ba9fae0a512651f9eac8adb7e383a4264d7902008f8ac2afffe88cd0aeec49cc947c31882564b054c4df2360e0971ec6b4b341fb367342fe9ab9c4d0906aef69b703f82bc22b53ef326f08de4ac617ee3de353bb707ed783af89907bf74434a0d8977a8e3bd6ce7f152329aa744ad86d4c81ab091b0cab6ee4b8146968511f182c7fe02c01376426c16d755cc2372916d3a33babc1151efa90da5613673c3a69e54398b8742f73cb844a0a54bf5694db01cdcc172f8db3242f7a56dc825842c9eb66cdd249d5c601a0bdac98c43381eb03ef4901421cdb13da0fe7823705a61fe2310f0f69e877fb7ee4ef76fd6f4f95e2589d0cd78771849ba8a9d152a242576feec87707864719cb0064e8380441f8b55dec862b9364c95745cba33b02e27f4139ed5377448344e3d393e62689f8123d2cdcbdb173ba05f3201a955756b80feb13b568acea4807e438f57200ad494fc7ee30e8ceecb98010270c4b425fca861d31f45563a28600a591e7742a1b58b84b9c822af5c7e92b84a52aa8f5cd1eab358ed3771acd04e8322b0d86e57e21d15ba7ff9d1873f14311924f738cbe915fe11aa373a6e9f7983d871992de78b6f558c7545c5fc6eb2516eb77c20f6b345c69a0afce4d293ffd13e5d85b98c14d6ecdda4d28b32a34ee2ba7abd1481db5c403b512fbc74c6b63a59625291eb148545f998d0974d52405b56f5330a2e0351f4b9cd3a6f61aa34879116354b8548418876a53c8e27c5445559e00b232046046405a283fb6b55349a717640e8c906de07a4853c0e45c625fdf3f9fee70440223798677351ec4751610fc20bd89f9d9108fcead95f6ee57326cb3973b07b20f04ef76f8810f20e5a348bddff0cee78618001f3184e0265286e83261956174e8ed347d25a78fa51bad0ba8060a3f1394d25e778a09eb5ccc9ea1f6fc9df1d4e7d8d453d3c1c86c6223b219719939a4adcf4334d514f17d6ca622ce0310d712188f8dd35690322e4500484095eb0ce8d881de14a9cadbf89824b6274f41adb7da79eeae064f5f1750f55ba0046d09723489683e60d310e647fc3efca98d65591a2d98f8510138e8a0a950bfc4138636bc36ec18b30334a93ed3c3d0ede6acfa1e6f7f553c9c9da87ef4030136c5e5b4ef63368a5b6b5b92c82d598f999c1333af4f118a57bca85c58e043cfb59c5dbfd9e57b17934ebd8f4810beb9ce725fcb5148ff5746b51c3e072233d19ccf3f48aac462dcfc241573ea3de913611bf2b166c851ee72a9c9636a35597c18881f5986251a113ad71b4aab0fce253d5d61f7227fe614df36f43364b1d69769fc4a3b23afc7043ca1ae81ec734bbf64b3f8042bca00378a39b7787e123709422e2c30cb642c0ffe4b571c59caa673e88ab92b930e0fb18cc498dfe1cb4fc3ae34c0ce883521ed4b1fc2505a6288aa14912c9bd216a30cb106bc087f8583578f87051c4e72f5ec54b1c7240db794c882d47ebb9325d69ce7002d74a652b89b2c86a8f969ec49cc7df0c7d197a99caed37fe39b78f218488523b8c6f66dc47eb8b84d5c870ee99f93cb92cd610d5097ff587c92de25814fbd896960d8c222220d86c7e4e4d9b3521f283270845dc03483cfd39f8eeb1f8a1bb3d968bd91544d22edab6092e110a5ae57062bc34a75f86a89cc217cffac9147589b9060bb0ceee3c7573a07b14e94aad6244b66d1656dd270ae5a3f1325bf854cc1932534312bb0339b7f1c2bea32bb6a6009fe6745999fa4a2141dffe151b78df173ca6472ac7d279e4dfef28599bb7721657e82c24b60a008a7a75c88f4af148b24730d7bf9444e36d96a154a7920a38429aea153876867991dabdb454b7d87df0d2456f729b38ebc573c713a7f67c2f9c6985d7a08ddd93d8273579a501bdc0717c7f24aa11cddf11724e131781b9609ffc3356a6d0b1e11688920063ba0ccb43376b2cc15aa868e39c8cb3d3552f232a8339b921008b981e554632ef0efbdd1b065875ff7fa6983c302c5757bf67746a1961620eeea35205bb0a46b676157b35e0c071a2a95c849a607f8173fe004e8e4a11e75da614292a88307099449c6142c6e99a2013d12b8591ea1f022e39bc0abd10e489246a3e502476e195ddb84ceca3e58e35d21befe283a37111c28d2d79d83988ab009df1fc0cde40765d0afaa8516541a2b48abdb2c576e61c5955d967798bfcde0ad3d5261a46a4cd5b3d71b033ce6aa95b594976581d7ea4397d4a439d8cac9e0b46dba50654b23c643ffa2da91e820283c9da8c6b79445e66fde2d617a4f9d5f324878c32dc8ede37fd89e8984468df9f5103a5fda7e0d5bec68f0c1ea0b7a4ee92841225e9f6724358066d9faec37bf96b0b3ead19d30abe0b68f685a01353277dd04fcb51b0dfb9eae3d3d0f5a95d9a63792a86a9a43ff33f324156b5c9e1a83115b28cc8847d4c84a64c1a7c441826128267682375a29bd7b3698892ece25d111b147443e2c0cd6bd037d3d265c6a7ff20477e35713c8b4e1b09215b4504de7eee07a28e7c95874c46337588f876d77611927721c78b13bf5fb10577bc2ec9cf6051a407c2ee71157f1bbacc9ea7e1449bc6f8d8e9c084013e01a6a817f4a3a57a9b5646328a2d188486e9e4a77470752bbb843eae5de3d6464205d533381c9454550224089f4fafa02a16ff649e2ad6921e2d978420d8604024c2ad8cdf5608f2ee63b20ca8ae3cc761518e2352edda67f7e93991ecee72f46fe3674f41598d43327426cee4c88e7ce575ba4a3520f69f529dde7932991a8ae007279c8a0f7b89f1bc971d5e4cce7269bc7377249a0114b23f309bd9ac6fbf2985c3ad44a3ce20e7adab02749e78e2c9b20e926c88e54d4b40db9b922831c5e99935e1447a0a04db41b4fbe751f683fbc992fdee6163095e7733f27aa5c5da90556ce6ae8b00a0a9d2e7cb0c2774f2169aaf97dfffe555024bc319e1282d103c2caf45b3021f94b03dea6eb788d0fde1f724ddfa108387fe4ed767f5174a825cb0728fb81262713889d4a4fb58ee8ea7b74777f7c2ca4729cbe84051e5290729b603dd6f61f00cbc54d254ef6e5a2073e33d56e838af8f4b0bd2664615f87054ee0e1c2e99b97f7e5c9b75f62ce8909d8e6579d31b2419aeabc87525e2ab64948a6f904d69a882d23f2cbca130230313347ff73bdb132187a9ad6ccc24cbda911a741865b71e233aac25b2ef31a2dd5ec8494f96afaf0cde0180b5b080077f7869d561b9ea593518acf1bb458d1c15a6ef42837bb7e3248b84e5e4ff268447daa19384962f871586170ba14eff4c11e50c99850cb10d7818cd488a56e3eaee8ab98781e4e10b09d9462e83d74cf854e40e8275fdb2325702f5bf16fa0593da1f3d3c39bc690e9b2a7cbb6cff415d8e07e5b8e9672e23f4e86a415fc8baa8af942f636631c7232bfb218ed6b1776434c1e644abbea3fdb705854e92e8e09c6bc72bfb21fa8da34ad5913e6c835eaa7f6a3995728ca3b57503acfaf959dc733aa672c1ad86677f891bd2b457b4d582d57b93fefdbb13fbc6a069c35d85018047d5c0b15f5d44ddf19539b6460af8ec3d2c1f4dc706301f160c743e12a1622612b0c6179a9913e2e180f4c0757e4efcfce522b41a82b079bbd2e71634546017fc2cce8bcc92f741e4e112924431bd98fe044e28b81ea7343954c6b2d54daebe6597b8a9de28dad1f525c3cfcd28dfc6a4a0894bf41ada3e564aa4e1c0ac1912e1fe29efd6eff7b71da8b7f1a668f0898f93b23b2a9b2f725d026e7f2612c51bedd374cc577477deddd7c0255d873dbccf3a33b74366272c3567be3b700eee879061712bf7bdce38adf4eff4061bb9ee8e62ebf9e5428e05a189bd093383dde0f73fdcc94d84ff14fdfed851f652485b2ae1edfab96040ae99450413064cddecbc8b8f615e6fab20a81b82cea2bbef31f43b03179987fcd418fd67900c6bf379311b2a3b7c50cfbf9d62a7fa243f9a02c391263feaa5bd3d819d4969e65829a3918754c2f1742b435beaffa3c77477732b30acc5c7a7a628c99e8e8f6e68fd883a1878668e6f3cca7ed58a79a216f08c1d3de0f8308dd7e7aff6b679804d304f4f0e85fb05de741f47034c50274db82eb9c140bd6b9ed32c42928eace0ccfd3864313736c14a1234f8740e0fbe255ed700ea6cf9d90871efe79b105a8c31622c3788c1c5ac346120f57b963212bcf7437baef3e729a9e0254ba3b406ee0bbf93fdbb9f15b65e4119301e4529f874e15be8ece8c6207ba8e3fd5840381aa10ae7ef4a55543c80937ca9cad3dad47da112ae92c03b10025d62263d6a25a793484af920263502173b37b9ba3bd4235b0672d36ab09cc8201634b33a6da153f0b2c4a94652d3b6522546496441a12ebbeaff2f2576527e156fe1e3b5be4d28d8f4cf48fbf1fc230c75a7bdf354d49a67453aa459663f6cbe8e42c6f3039d1b044d133cd3557b815470b968a4b72bf7df4a3d2461c2907dc6582fe23e1980b49755b44b885d1d4052d0c80d6534d2ee9e65fb4ca269ef45688e4b89bf26e35d6ce3c47eb9944b12b3ea7715ab6add835c0816ccc0c4b5d08662c77baa5d56ee2bdfe941959edad72150fdce03955a6fde954f37afe6c9a0d5c0ae2b9e8d7b3cbd90cf3f5db9403aa84a86cbcd8dadbf486dca2222f198ba53acc8d4580653d9b30541742fcec7e8ee4b0b67162160316171c6add51a1b77801cdcc166b36f57f13c0db2b023fe21b73504339b8c53f39c4bdda697311c3406f0be8b4d7757ee0c98977abe96d4b22946180d667450f9180af8fa5c039b841fe09ea5259351309dd07645de84d2902c7e1ba57eed27dca51710b4630330214e820246b21ead741172dbb48924c404a909a41ad1d1d0f52c0a80f4f85e14c4f68b9a569be4933bdc16a013b518e84e72330d111438d90a4de8f1026fa1c4c8ea9b9a6dcc14fb2ab39b472542cbda944495a9cab80a84a49"}, {0xe0, 0x197, 0x5, "086276d16f9806ee6b813c31ab912299e4ba09b9491b99c478248bc982211ec2809df21749542e3f8adcd2b7492447a9a1910d10670f06816e861d90386bf1b1d1f7bf0f57f824cfad069b8a94cfb1680abe4395d24ea9b765479daab326c73c39704fe843b180bfb6d9cd773aa796f285bd59f1f472a4ae9a6e71f9b7c55779c2bf44152f419208105b2bf579a48e0f9b6bc3700b3d0f66b4d02a6512156131031289f79b0571736b9824684cb6688534d696f10a2013adba2d9748afd59c92f0ab9e9fb537ce6f471214"}, {0x80, 0x11f, 0xb80, "cc509f024b153ed476125d457db23293994043f24f81cca64f0cfb8e7e33990ec7477e7d438bf1c0a5aa61207afa35d4a625b08c52f9f148d6863abea4e3c20a20e9478491ceba89450134b5de75a462323adcd8cb9ab65e738416617a9d9243fe2e04c91d17844e0ca48169f3"}], 0x15d0}, 0x0) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000100)='erspan0\x00', 0xfc) ioctl$TIOCCBRK(r1, 0x5428) sendmmsg(r3, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1, 0x0, 0x0, 0x1}}], 0x1, 0x0) r5 = socket$kcm(0x11, 0x2, 0x300) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x5411, 0x70cffe) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f00000001c0), 0x4) [ 895.985485] binder: BINDER_SET_CONTEXT_MGR already set [ 895.999107] binder: 1836:1839 ioctl 40046207 0 returned -16 [ 896.012536] binder_alloc: 1836: binder_alloc_buf, no vma [ 896.024977] binder: 1836:1845 transaction failed 29189/-3, size 0-0 line 3035 04:48:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 896.033036] binder: send failed reply for transaction 1751 to 1836:1839 [ 896.055236] binder: undelivered TRANSACTION_ERROR: 29189 [ 896.100111] binder: undelivered TRANSACTION_COMPLETE [ 896.119911] binder: undelivered TRANSACTION_ERROR: 29201 [ 896.161985] binder: undelivered TRANSACTION_ERROR: 29189 [ 896.168029] binder: 1861:1862 got reply transaction with bad transaction stack, transaction 1755 has target 1861:0 [ 896.186652] binder: 1861:1862 transaction failed 29201/-71, size 0-0 line 2816 [ 896.200147] binder_alloc: binder_alloc_mmap_handler: 1861 20001000-20004000 already mapped failed -16 [ 896.210865] binder: BINDER_SET_CONTEXT_MGR already set [ 896.216774] binder: 1861:1862 ioctl 40046207 0 returned -16 [ 896.223715] binder_alloc: 1861: binder_alloc_buf, no vma [ 896.229713] binder: 1861:1865 transaction failed 29189/-3, size 0-0 line 3035 [ 896.238137] binder: undelivered TRANSACTION_ERROR: 29189 [ 896.247862] binder: send failed reply for transaction 1755 to 1861:1862 04:48:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 896.259420] device nr0 entered promiscuous mode [ 896.268672] binder: undelivered TRANSACTION_COMPLETE [ 896.278329] binder: undelivered TRANSACTION_ERROR: 29201 [ 896.284830] binder: undelivered TRANSACTION_ERROR: 29189 04:48:40 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000001340)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f00000013c0)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000040)=0xcf7e, &(0x7f0000000080)=0x1) read$FUSE(r0, &(0x7f0000000200), 0x1000) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000001200), &(0x7f0000001240)) write$P9_RGETATTR(r0, &(0x7f0000001280)={0xa0, 0x19, 0x1, {0x84, {0x3, 0x1}, 0xa0, r3, r4, 0x2, 0x5, 0x3, 0x1, 0x80000001, 0x6066, 0x0, 0x7, 0x3, 0xdae, 0x1, 0x5, 0x27ab, 0xffffffffffff8001}}, 0xa0) [ 896.319924] binder: 1867:1868 got reply transaction with bad transaction stack, transaction 1759 has target 1867:0 [ 896.332317] binder: 1867:1868 transaction failed 29201/-71, size 0-0 line 2816 [ 896.349903] binder_alloc: binder_alloc_mmap_handler: 1867 20001000-20004000 already mapped failed -16 [ 896.393266] binder: BINDER_SET_CONTEXT_MGR already set [ 896.398621] binder: 1867:1869 ioctl 40046207 0 returned -16 [ 896.411945] binder_alloc: 1867: binder_alloc_buf, no vma [ 896.427343] binder: 1867:1872 transaction failed 29189/-3, size 0-0 line 3035 [ 896.442487] protocol 88fb is buggy, dev hsr_slave_0 [ 896.442675] binder: 1867:1868 got reply transaction with no transaction stack [ 896.447752] protocol 88fb is buggy, dev hsr_slave_1 [ 896.462797] binder_thread_release: 4 callbacks suppressed [ 896.462808] binder: release 1867:1868 transaction 1759 out, still active [ 896.475971] binder: 1867:1868 transaction failed 29201/-71, size 0-0 line 2801 [ 896.483425] binder: undelivered TRANSACTION_COMPLETE [ 896.488561] binder: undelivered TRANSACTION_ERROR: 29201 04:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 896.502935] binder: undelivered TRANSACTION_ERROR: 29201 [ 896.508483] binder_send_failed_reply: 4 callbacks suppressed [ 896.508489] binder: send failed reply for transaction 1759, target dead [ 896.563532] binder: 1876:1877 got reply transaction with bad transaction stack, transaction 1764 has target 1876:0 [ 896.577482] binder_alloc: binder_alloc_mmap_handler: 1876 20001000-20004000 already mapped failed -16 [ 896.602560] protocol 88fb is buggy, dev hsr_slave_0 [ 896.622788] binder: BINDER_SET_CONTEXT_MGR already set [ 896.628899] binder: 1876:1877 ioctl 40046207 0 returned -16 [ 896.641710] binder_alloc: 1876: binder_alloc_buf, no vma [ 896.647822] binder: release 1876:1877 transaction 1764 out, still active [ 896.655762] binder: undelivered TRANSACTION_COMPLETE [ 896.661299] binder: send failed reply for transaction 1764, target dead 04:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 896.715225] device nr0 entered promiscuous mode 04:48:41 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:41 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) mmap(&(0x7f000042e000/0x2000)=nil, 0x2000, 0x0, 0x30, 0xffffffffffffffff, 0x0) [ 896.761535] binder: 1881:1884 got reply transaction with bad transaction stack, transaction 1768 has target 1881:0 [ 896.778923] binder_alloc: binder_alloc_mmap_handler: 1881 20001000-20004000 already mapped failed -16 [ 896.802611] binder: BINDER_SET_CONTEXT_MGR already set [ 896.816622] binder: 1881:1884 ioctl 40046207 0 returned -16 [ 896.842678] binder_alloc: 1881: binder_alloc_buf, no vma 04:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 896.870610] binder: send failed reply for transaction 1768 to 1881:1884 [ 896.887664] binder: undelivered TRANSACTION_COMPLETE [ 896.970553] binder: 1901:1902 got reply transaction with bad transaction stack, transaction 1772 has target 1901:0 [ 896.984439] binder_alloc: binder_alloc_mmap_handler: 1901 20001000-20004000 already mapped failed -16 [ 896.996165] binder: BINDER_SET_CONTEXT_MGR already set [ 897.001889] binder: 1901:1902 ioctl 40046207 0 returned -16 [ 897.009435] binder_alloc: 1901: binder_alloc_buf, no vma [ 897.021133] binder: release 1901:1902 transaction 1772 out, still active [ 897.031215] binder: undelivered TRANSACTION_COMPLETE [ 897.049627] binder: send failed reply for transaction 1772, target dead [ 897.257847] device nr0 entered promiscuous mode 04:48:41 executing program 4: getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000540)='/dev/audio\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000009340)=[{{0xffffffffffffffff, 0x0, &(0x7f0000003280)=[{&(0x7f0000002200)=""/66, 0x42}, {&(0x7f0000002280)=""/4096, 0x1000}], 0x2, &(0x7f00000032c0)=""/224, 0xe0, 0x9}, 0xfffffffffffffffe}, {{&(0x7f0000003980)=@ipx, 0x80, &(0x7f0000005bc0)=[{&(0x7f0000003ac0)=""/4, 0x4}, {0x0}, {&(0x7f0000005b00)=""/119, 0x77}, {&(0x7f0000005b80)=""/23, 0x17}], 0x4, &(0x7f0000005c40)=""/4096, 0x1000}}, {{&(0x7f0000006c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000006cc0)=""/230, 0xe6}, {&(0x7f0000006dc0)=""/66, 0x42}], 0x2, &(0x7f0000006f00)=""/245, 0xf5, 0x1000}, 0x5}, {{0x0, 0x0, &(0x7f0000007000), 0x0, 0x0, 0x0, 0x800}, 0x7}, {{&(0x7f00000070c0)=@sco, 0x80, &(0x7f0000008300)=[{&(0x7f0000007140)=""/136, 0x88}], 0x1, &(0x7f0000008340)=""/4096, 0x1000, 0x49e1}}], 0x5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, &(0x7f0000000040)) r3 = syz_open_dev$admmidi(0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000001c0)=""/252) bind$alg(r2, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r4 = accept$alg(r2, 0x0, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000440)) recvmmsg(r4, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x1, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1, 0x0, &(0x7f0000001380)={0x77359400}) r5 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x81, 0x0) ppoll(0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400)={0x3}, 0x8) getgid() ioctl$sock_bt_bnep_BNEPGETCONNINFO(0xffffffffffffffff, 0x800442d3, 0x0) setregid(0x0, 0x0) ioctl(0xffffffffffffffff, 0x5, &(0x7f00000005c0)="3f0992e19136edf75fc2f570d1674dc0d69c5efc18b79a7c33582e9920d7dee8681675d566fb06aa63fed5a688070c7f964c2f35a93b17b254c3bb625f98a455221cb94b0e5f491f752abe698d9a8da5c2301a3588f41b38b33ed67fdadbf5670e94") syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') write$selinux_attr(r5, &(0x7f0000000080)='system_u:object_r:modules_conf_t:s0\x00', 0x24) 04:48:41 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0xe2a19c164570ceff) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) write$P9_RWRITE(r1, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7ff}, 0xb) 04:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:41 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8040}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000140), 0x80800) r0 = socket$alg(0x26, 0x5, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff}, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x6, 0x200000}, 0x10) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000900)) r2 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x2f5}], 0x30}, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r2, &(0x7f0000007e00)=[{{&(0x7f0000001240)=@alg, 0x80, &(0x7f0000004700)=[{0x0}, {&(0x7f00000023c0)=""/49, 0x31}, {&(0x7f0000003580)=""/4096, 0x1000}], 0x3, &(0x7f0000004780)=""/245, 0xf5}, 0xba02000000000000}], 0x1, 0x0, &(0x7f0000008000)={0x0, 0x989680}) close(r2) lstat(&(0x7f0000000280)='./file0\x00', 0x0) r3 = syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x4100) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, 0x0) bind$tipc(r1, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x4, 0x2}}, 0x10) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r3, 0x5460, &(0x7f00000002c0)={{}, {}, 0x0, 0xffffffffffffffff}) 04:48:41 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x80002, 0x0, &(0x7f0000000080)) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) read$FUSE(r0, &(0x7f0000000200), 0x1000) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x200) [ 897.347860] binder: 1912:1916 got reply transaction with bad transaction stack, transaction 1776 has target 1912:0 [ 897.399405] binder_alloc: binder_alloc_mmap_handler: 1912 20001000-20004000 already mapped failed -16 04:48:42 executing program 1: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000280)={'filter\x00\x028\x00'}, &(0x7f0000000300)=0x54) [ 897.467631] binder_alloc: 1912: binder_alloc_buf, no vma [ 897.467657] binder: BINDER_SET_CONTEXT_MGR already set [ 897.495314] binder: 1912:1916 ioctl 40046207 0 returned -16 [ 897.522113] binder: 1912:1922 got reply transaction with no transaction stack [ 897.562233] binder: release 1912:1916 transaction 1776 out, still active 04:48:42 executing program 4: getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000540)='/dev/audio\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000009340)=[{{0xffffffffffffffff, 0x0, &(0x7f0000003280)=[{&(0x7f0000002200)=""/66, 0x42}, {&(0x7f0000002280)=""/4096, 0x1000}], 0x2, &(0x7f00000032c0)=""/224, 0xe0, 0x9}, 0xfffffffffffffffe}, {{&(0x7f0000003980)=@ipx, 0x80, &(0x7f0000005bc0)=[{&(0x7f0000003ac0)=""/4, 0x4}, {0x0}, {&(0x7f0000005b00)=""/119, 0x77}, {&(0x7f0000005b80)=""/23, 0x17}], 0x4, &(0x7f0000005c40)=""/4096, 0x1000}}, {{&(0x7f0000006c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000006cc0)=""/230, 0xe6}, {&(0x7f0000006dc0)=""/66, 0x42}], 0x2, &(0x7f0000006f00)=""/245, 0xf5, 0x1000}, 0x5}, {{0x0, 0x0, &(0x7f0000007000), 0x0, 0x0, 0x0, 0x800}, 0x7}, {{&(0x7f00000070c0)=@sco, 0x80, &(0x7f0000008300)=[{&(0x7f0000007140)=""/136, 0x88}], 0x1, &(0x7f0000008340)=""/4096, 0x1000, 0x49e1}}], 0x5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, &(0x7f0000000040)) r3 = syz_open_dev$admmidi(0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000001c0)=""/252) bind$alg(r2, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r4 = accept$alg(r2, 0x0, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000440)) recvmmsg(r4, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x1, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1, 0x0, &(0x7f0000001380)={0x77359400}) r5 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x81, 0x0) ppoll(0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400)={0x3}, 0x8) getgid() ioctl$sock_bt_bnep_BNEPGETCONNINFO(0xffffffffffffffff, 0x800442d3, 0x0) setregid(0x0, 0x0) ioctl(0xffffffffffffffff, 0x5, &(0x7f00000005c0)="3f0992e19136edf75fc2f570d1674dc0d69c5efc18b79a7c33582e9920d7dee8681675d566fb06aa63fed5a688070c7f964c2f35a93b17b254c3bb625f98a455221cb94b0e5f491f752abe698d9a8da5c2301a3588f41b38b33ed67fdadbf5670e94") syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') write$selinux_attr(r5, &(0x7f0000000080)='system_u:object_r:modules_conf_t:s0\x00', 0x24) 04:48:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 897.573440] binder: undelivered TRANSACTION_COMPLETE [ 897.588252] IPVS: ftp: loaded support on port[0] = 21 [ 897.591142] binder: send failed reply for transaction 1776, target dead [ 897.700399] binder: 1935:1936 got reply transaction with bad transaction stack, transaction 1781 has target 1935:0 [ 897.733966] binder_alloc: binder_alloc_mmap_handler: 1935 20001000-20004000 already mapped failed -16 04:48:42 executing program 4: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) r1 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x6}) r4 = syz_open_pts(r3, 0x2) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x8) dup2(r2, r4) [ 897.762238] binder: BINDER_SET_CONTEXT_MGR already set [ 897.774845] binder: 1935:1936 ioctl 40046207 0 returned -16 [ 897.788747] binder_alloc: 1935: binder_alloc_buf, no vma [ 897.798266] binder: release 1935:1936 transaction 1781 out, still active [ 897.819600] binder: undelivered TRANSACTION_COMPLETE [ 897.835978] binder: send failed reply for transaction 1781, target dead 04:48:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:42 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x460201, 0x0) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f0000000100)) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001c0007101dfffd946f610500020000001f0000000000010008000d000d000000280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 04:48:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001540)='/dev/rtc0\x00', 0x4000, 0x0) ioctl$VIDIOC_QUERYCTRL(r1, 0xc0445624, &(0x7f0000001c00)={0x7f, 0x106, "1f486a4bacc10fc0c25bd8a62d6edb2d2fd1f049e4cc30c774c12890caef0357", 0x80, 0x0, 0x7fff, 0x3, 0x10}) writev(r0, &(0x7f0000001240)=[{&(0x7f0000000000)="a5f82fa37d554e26a436c29c0d06b7381b32fbe7f5e82abb8875382836f9eac2f3de66a6e4808d713ba834c125ff87f4c2e8756e8bdd69ee4ffc379aebca9c45efb68c6d66391c6e806cb4d46a2ceb84bd2725c8692ea4a4e093bb5c0ba72f23b6e714a774b962e6cab7d8a26c6e96665d5a831c69d3b9552308d227db404c949cc9ca2177d5793aaca93af9c7e3816d6a67e04b83510e6dce481ae2c61e8ef834bdd40df773241e07bfe8028a40c142edf80fae5a3294b050b7a263732a9bf2de68d10c23866ad866344291e90af930dd2b81193a2aae7b7c8536995c5e8145b043854a480dcb62cee4e1182415985ad134c8dcf737608d"}, {&(0x7f0000000100)="fbe12d004989d08e55c43d15854ac88dc68e3de736151218e79d95a071f7e08340f18c2453b775aecdafda4f70b2eba028fabdac4f36beb6bad67cc2561e0d8fc6cabe625f5f0f395d4d880380e1cd3d104608344ccad46bb3ce6eaea3b81962bf8dbecafc07f4c75f1ae377e331255e0dfa0b72eaf331ca46487c6bc44f9c0c4ff4fc3a991cc45e28de66bbbbea3a813acce32cd1aad446f789ec4262c1b42d4ed630ea33368fb452d8f95bdc8502feef11300815a120a3c77126146abf40babecba4ac24da2a4174dcdde00d91c63a32ce82d6a232f48f9f068f16f1956b0902a3266d18df75a1721a", 0xffffffffffffffdc}, {&(0x7f0000000200)="1ec7274c222eefa15deff3d12db24f6c5ce1051d55eeef3eedd6b78172e8bceee81209a8fd13554d2666d53eb6f27354", 0xfffffffffffffd85}, {&(0x7f0000000240)="9bc2d4150e87865068678e45dfeaf3ce4e23c973fe5550f224fd1b373b9c4717b26e7b6cc2480fa374750c5d754ccbf763c91e000972071240595cfd1a4fe50314842b01d945fa77e9081d9453d97ab570c644f6e62e02dbbc48449f00586a4d9406e5cd66c859d7aec6d5eea66d845e314f7cf1fc829233e90547550ab822d56c0569291b873641ac31a65bc3cf7688987ac1b4a85b5b581d807c9e3c6f415f0a974053befdb5c81780d30cde2298e2272c620b097f5d46aa479532031563ed15731a16736bfd15067580cac29bd064d1e62494d880bfc125c3291dc77838a9ee6bb026235e32fceb4452d0572c44e38f5d1631dc36fc8511b306980ca68b767dd3990634b5f772f8c421cad988867436a5bb04f23a08a08a93160ac264218c2bada50f2342da9a3b32c87e05207e5f3bc806d63df611eb9bacd69a1c6736c6d991ca688ad9015cd77d6ee148e3ddab92516c6116eb5de2157ea98e8b345cbba7fcea98ad5bdccf8b9798b551ecf9924752b33403247f14ae2b892c0cb4fd4a29f0b2db500bbbf0807209c836d8f5321b753ab6f4f0f3e9101ae04913dc3135165645bebc9c22bb7300f860d061ce4e5a150a2a46efc7fc1094ec985b7b2ee8d72466fc28cedd86251102511d3e969ebaf99fecc047b1f59ff3b7e28c77c81e3a01d058ca673412991e1f05a2c97628ba1e74c5c84402f96e1158bd9097e703af340a3b0b06787162ef931429d2e0bd44ffa93b382944977888db1360449289175c12d4e467dc7bbb3a8b4629898c6dae599c476c1336abc7ed8135dae7259bb52ab745c314ad925e8368c5822f71dfc4ece7178ff0ae3f13c9f0c2252b2f786e66667be99d3cc649a3c388797f03abdf7170e9edfe4d01cda6ced3519803ac01c2bf757d13c8f489bb89ff78d8ac601448f1bc4e571efc49dd7023171cdc09b7477614fbef68dcf22daf34238e92a2fb5a4d2becbf78df03b8a0f9b83bae625440e370f3a0c776c2e6829306e0d960375315627eba01c78b6d660d0a3f1303a32323ba74f7895e27454e7bb202ff6199fcb578b325c0519216bd5b75e42881c0fb7232c37e0c1979411d37df28790e2f113f14bb694d22b9f82297298dbff6305f161ca7353f4b0df8539eae31a9636f3cf1eb54a428013ee45752be61337ad95e80c0a69e1021f01abed9611fcab5f9cc5b947cc099bf46651c756b0ea5eeb25ef21bcc8763a7043494ca4bac9f661d2a6b59b6f13ec6595fad85ec9a0b2e588580942bc89889339525d4f3cff83f740798fc6c8efe63a05f55a666af9e85f1deb07b9550b4f579b8bfb807f5c86e5a24a88d0058d17d5b9bbc3b6880493a9fe5f3fb86c98f04769c6df1e6b2cdf5b40874e69473b476a24c128f47032a0350ea2e666e3aab823a95359de6ff722f79ded917ab67e19a78078e6257e33715b8deba7215d6e133528b768dbd43328396ca26b8228a7a1dae66da79b20e105033950d67e298ef7333bc493fd5c02b79f0cf4cd764592bde3fc5dbdf157750e3644094bb5289b6c2205eeaf91c358aee994d244804a8987e3348d74e70492279e90307679af431fbaed97946474ccbeaee5b9a2b45111fdc30e047f50fdd36b7c330fe4fc0926df900e5a6d70f7908ba87f4cceda861746076b5ca00bc196bae692b4c5c111a205de70925d8d5d88e6372d8f6406c448fc7bf6a7be5e4366d36d4c19f922a3c1f1b201f2435ba6b2b28ab0fcee0f9d4ca5caa4570be8aea5eceb8737df2fa5d673e312c4b8b67f3643f4b41a67dbd8c36f460aab94db9c2092a76eff2d4061344d4c7283bb1f0ea8533700509a7318eb6e4ebf2852fc86ba587c3793a1959ea013d0330f9e0598b6e48a348f88c22e4607be09ac9537fe8c4cf9d138ac0cfedb752238e408de215d8eae01ab948e113db49d8ddba5fde45b64ae90b80e7c611c212c05080b677ea58518b2818c2d0e817ebf3d070a3d40743fb4904784161845d2cd5847ef626b841a5f3b41b53f4e994abde5738653943f3e11907b5728bb883647a358e2c1f86ce647ac5c0c81caad966c2037e90e67bc641c164f4c2c7cfec94fc5334c691839d8a60401a55846902787bcea511cfc69983ad2ba4f9a8915dfdf1d01a648e8229d3d65170ea80f9c0089e86d2b23a0679561efcbd3ccd7282b0ac1f62c0428131644e1f7cf22dd8919f708463a4313924241864009070c0922d8158e46be196615a8f3860cf8c0e60a48916c041e4848fbf32d2ae66c7cd679a101537b053f2183dad762b3528b0883059b2f098711a2b91c89a8dce1ec2462ed44e6a77a210c84c140fc4a372412e70789aca32c5883a8be7988ffa5bbf5b4aa73d104663ff8133cb96dbdc9a8c639cf1b064936d779ca6e688706eddaaabb40ac851559ac3318d2f3e50b91a2437b6ad5184fe754200b768822c5abd4ea688403b4ac6ddb265b49d5b9039d3e6ab1d74444844a4c73a60bb5f8fdbe8f162035e21a6b48ad78120787a184c5b1cf2d4b3bcd0d67df93093ff22ae8204a156a711c35fa88ac969eb2f143c29805d39411b270446f7afb70625eeb1a72f4cf3b2bf94b91e0f5d62cf34e744fa653b1c3d72f1176e553f651ace0d2a5a2cf34c91d0d4a2273548c4da00d9506cf3fec1c744c962f0725d1c8e2ca04a31496d854f589564e082f74d9c96d242be5dd4a73121597d33e348988cc64f291e8d747e32a1727b24be33d1ded3df25b1dfbc3a3be57191902e27cf1e475556abca51de862b323e46a946617cc09fd05281b8f38392c4272f9a500e1b99b02617cbdc36f7072d08fbe8cd948bdf8045fc43d43a9a59b1df1ecd20adafb9159cf1be311280a1f33a6ffce56d2e14d7b284c57c9d405b9686dff87eb99a282eeca405de816d0a41e8ef5d4b5eab58bfebcb2cde0818ab90544523500a2a5023d703f96df2369450ee96ca943a18463f44361032c46f8064a589e4a9e110fbd9e1ed8bc3390e0d8d55a6f07f133b6b3ff7aa53ecfbea17a286dc2eae9ee2d6be151ede75ae6ee6a78aa471a4c16baea9937709da0df5d4bc3a961aa71c66009762b27ff001288a05c55fc944a228c4261eb52ced18074861b35fa94df204b18246ec7f46564a511c21e58247657d94728b7f5b528238391bcbb061d4d729174d6eef14c8e6c8d2fd3bca40639d232a5e539958f94dae92d15fcd8423587b246f7ba1bc9e1fe1d86af7421e4e54794595f1377e21cd04310687a8e6998c53b784458f2e7031a709adeb21a2290be9d879e707c83c942ebf8e405e325e03c62d851aa91ad3674854f65631f78805a786e05dabe9a58a667add94925e05f4f577d61b2c277335239026192f6165ca5a8a14263c0a7e98eccbdd64d2a02112125e19c1fc4ca9940dad774b11a6979acdf712e7957b18b6c996ebee815429aae6595f50c2c3fd8ccc898eda49f37c76514d4491c8ee9c2d741aa2731b9f2f5e7135ee814aa9787ee8dbea89e9a86d27f3dd01ee39ea410d9b14b30c94429fd5911ddea4d5ece1a2dace9dfc4da7af706efc590ccbc3bcfa072250301e12d9ef6372547ce00dd62bee210df61e0155022c5b4a215a5df6da045269fa266aed6c9ccf9c40bc895ca8f937704c30ef47154cf287d7c74821f4c36b31dc8672b145a49afe90b2e3ff349b5cc78a282cc6eae34772815d7d546dc0fa33142452a537bebd23d21bdcfc252c5ab54c9078cc3409cd2a5ae0a9c4b491ba170511ad1b00f38876b82b1a8beba22eb3cdc21efecc6bd14ae4eeda54c2409e02bc6e62b1c2ebf1ce16e1036d4e4b198582b8158e41f0269d9561f4886c0d302f17bff3d48c722a2e321d8b28ab3b026f48649ab26acab12d99d437a563968b62c7b7984650feb1f21fcdaf99b0f4429e587e38030a833bb056aeaff9d67697083316f4c41570055e0c8cbbc5e5840de7affa63b501b38a910aa8ce26dd744fd46c9f6bf459b3aea236a0a1b4412b20744f7d6dcf6b010f5b1b9c0e0b95e1140221ae04c7712d9a6177eb902feac7c0a7fb1de90fd46f03ee98e8ac31aec66dbc950e4c85420f53c2143dfc9d35452bf1763373a61f7d53af5a503daa015732e15d3329051feb8e13ba8851db6cbd3ea539a83bb905d96c707d8168afbaaa316e12002022c5faf0ebf3fec1419d1736f433b4f7675849cb4e7900868ed4c928ae18e0bd0a84b9c642cabdd42aabfd34495f7925bd2e1686506b3c9b231476196642e886adc4c9e37229e57eccb3110dd7746d4f3214471099889be6656347e0301faca7e2ea64e38b721aab3bc66005725226926b1563b59726fa28e939ff2680024e29c22737a20bdbb4214d0fb95ed9bd140c93e736b59ddc21e1af4f55df2d08911c436188e0b330087db1e6647e1150c95d74356d86a72c3aa88a360c17f1c60df6d97347c47fcfa5bed71fcfd363da97644eb19e59741d7134d7a288af2518e121e043ee19946be3ade6a338c87f114d7b3f52127365da02aa459ed8ee1b2cab5a805e9fd8fc2261819c4a1772bc963ec70a050c6d724971532f02974b4b19865a2f26166c9e6a55fdabba2e7e743e91adf21351e32122738288bb65143a5a0d9526b0b68d3f7c86c886c5432ae72860e652189513c861043a410c5113ca45d61e121d0516277a8b0934b07dcc62e9353be9d2110179ed67a21749f6901d3245fb1fde3f92e7b4b223d3243b6e6ee59d00948cd8653bdf135984e39b1c2691555b5d919928d56b8bbb92a392f437ab409527c79c393661df0253287d6db127458d72e53bcc9333e8008e0e44f4c6eb2ac3f88dfed8ce289dcb9c4b6fa44002468bbd0160409015be257502c2fcfea386b08ce1524935307aee43c7b83be92d1514ec6cec73ea516a31950d5f7fe93816bb2ef0618e70e4cf922f63b8d308cbe2c40a1a58cf81b0450e88752d89c17e8c2d79ac7ac5c6eea7fffe03ed0fdca76896ccdda2649da9734eee46f90b4de396c69aff1c260ac1e4358331f7b13ce74982ac4d098107c72245d7584246477f3c3e775be95490270019defed92be443a740bfa29953cc37c1914e147d40ef96570329366490fd2350d5384a3ea2b0576b4ac55e704b8e215edf0d95f1729093e08870a4a232b17151f11ed983c214e45323808bab28ac500d1bc8b42df0c0d8bab0a2d69ad2f38e5cd13a8d35c4f71515ecea2f2f09b48249eadb56aa4961550fd972f3b7fe1db2f76d75cbe1f00490bfca1114c105793ead2bd5a746c98bb28a8a495af394a025f9f568a1245146f72fef2e76b4e05d16a3a6b2fe371bae9f2f3175a873cdecf3e41cb0102453a2a29f6c7068c60e30aa9b8da337cb6c212922a8e8df51073fa054b9edc6341438f93d16243ad718496c4281809aa3b3487bae5488b8ba7bca791a52486ea38e5fcdda6b648dc787bee524acd40c7d4d6a76f099541186ba763fb94a4cb429b79bfc2b7eb3e0c3a30c84ecd79b7b7425cb113dbe625a7238ac925b9feb5ea9bcb766b2f3a675bbc9ac3c7a86a29ba5e6ac4a1f3cf6928d241513f32464bf444a2206d3d98ee2688187a5b130f676fca4aa9415a978c2946ae9c7dccece7672d0dab7b16c6a0c1c8c69a96d891107c0199c4526e691ae4ef767594101535315f8f0d03ffd6f852786c788258704ac96eb3c70bb287c2c4e8209fae13ff222a2771ef42aec32d6e904e2ab185a1f730c23f628532c4dc2b2fc3fab99de555b72b49a363d0f14d5533b58aad2e9c64d461e4d4eb46c0686c847fd18ff71e4386eab7e2b3fb96ee188"}], 0x10000000000000af) r2 = syz_open_dev$usbmon(&(0x7f0000001440)='/dev/usbmon#\x00', 0x6, 0x40000) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001480)={0x1000, 0x5000, 0x727385a0, 0x4, 0x7}) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/sequencer\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f00000012c0)={0x0, 0xa}, &(0x7f0000001280)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000001340)={r4, 0x75ac}, &(0x7f0000001380)=0x8) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000001b00)='/proc/capi/capi20ncci\x00', 0x80040, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000001400)='/dev/qat_adf_ctl\x00', 0x401, 0x0) r5 = syz_open_dev$radio(&(0x7f0000001300)='/dev/radio#\x00', 0x0, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000001b80)={0x53, 0xfffffffffffffffe, 0xfd, 0x8, @scatter={0x8, 0x0, &(0x7f0000001980)=[{&(0x7f00000014c0)=""/7, 0x7}, {&(0x7f0000001500)=""/24, 0x18}, {&(0x7f0000001540)}, {&(0x7f0000001580)=""/180, 0xb4}, {&(0x7f0000001640)=""/101, 0x65}, {&(0x7f00000016c0)=""/200, 0xc8}, {&(0x7f00000017c0)=""/236, 0xec}, {&(0x7f00000018c0)=""/134, 0x86}]}, &(0x7f0000001a00)="6724c0876a0869f361529f3a8beb9e8c167d3ee3e2bb67255da0bfb1701b541c4aad5cb561e2ae742f0f2c38b4ecca9a08ac586bbcdeed843811f3895a7b2d3d83187bf49cc7feb5c4b9a27c6dc55bf870d847e70155e8503aa7733a0aac46742cbc691ca2c6e7a6f21b2121a09cbc05be166009b81617883116592a6501c9310019ecdff0654a5c991422f1f6639a9a300cf8bdddd3977fea91af1664ee5ae4bf39d341357a21bab6e6e792480d7ca06917aee697ccd7eb0a78413d27087b761f1c2b5f39ff61ec0d3b99d9cafacb66dba3840fc43c8adfbfc65450d512de1b2116fcd568ed161fcae120b333086d45bc7f9a38a9fc763eb023632995", &(0x7f0000001b00), 0x1000000000, 0x21, 0x2, &(0x7f0000001b40)}) [ 898.056598] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 898.065945] binder: 1944:1945 got reply transaction with bad transaction stack, transaction 1785 has target 1944:0 04:48:42 executing program 4: socketpair$unix(0x1, 0x400000000002, 0x0, &(0x7f0000000000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x2c4a01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDGKBLED(r1, 0x8004510b, &(0x7f0000a07fff)) [ 898.115761] binder_alloc: binder_alloc_mmap_handler: 1944 20001000-20004000 already mapped failed -16 [ 898.129727] binder_alloc: 1944: binder_alloc_buf, no vma [ 898.136001] binder: BINDER_SET_CONTEXT_MGR already set [ 898.167102] binder: 1944:1945 ioctl 40046207 0 returned -16 [ 898.183507] binder: send failed reply for transaction 1785 to 1944:1945 [ 898.190390] binder: undelivered TRANSACTION_COMPLETE 04:48:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:42 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0xff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendfile(r1, r2, &(0x7f0000000040), 0x8) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:42 executing program 4: r0 = socket$inet(0x28, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000140)={r2, &(0x7f0000000080)=""/132}) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x28, 0x483, &(0x7f0000000000)={0x0, @local, 0x0, 0x0, 'sed\x00'}, 0x2c) getsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) [ 898.311381] binder: 1961:1962 got reply transaction with bad transaction stack, transaction 1789 has target 1961:0 [ 898.368806] IPVS: ftp: loaded support on port[0] = 21 [ 898.390808] binder: BINDER_SET_CONTEXT_MGR already set [ 898.400433] binder: 1961:1975 ioctl 40046207 0 returned -16 [ 898.410190] binder: 1961:1962 got reply transaction with no transaction stack [ 898.422464] binder: release 1961:1962 transaction 1789 out, still active [ 898.438087] binder: send failed reply for transaction 1789, target dead [ 898.727097] device nr0 entered promiscuous mode 04:48:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:44 executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000100)={r0, 0x8001}) r2 = getpgrp(0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r2) bind$can_raw(r0, &(0x7f0000000240), 0x10) setsockopt(r0, 0x65, 0x1, 0x0, 0x0) r3 = socket(0x1, 0xa, 0xffffffffffffff7f) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000080)) 04:48:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x4}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={r1, @in6={{0xa, 0x4e20, 0x450, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x80000001}}, 0x1, 0x6}, &(0x7f00000001c0)=0x90) mount(0x0, &(0x7f0000343ff8)='./file0\x00', &(0x7f00000002c0)='autofs\x00', 0x0, 0x0) 04:48:44 executing program 2: syz_emit_ethernet(0x7a, &(0x7f0000000000)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x44, 0x11, 0x0, @empty, @empty, {[], @gre}}}}}, 0x0) pipe(&(0x7f0000000080)) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x7f, 0x3, 0x1, 0x9, 0x2, 0x50e, 0x40, {0x0, @in6={{0xa, 0x4e22, 0x3, @mcast1, 0x1}}, 0x200, 0x0, 0x8, 0x100000001, 0x8}}, &(0x7f0000000180)=0xb0) 04:48:44 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) r1 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'e \x00\b\x00', 0x2}, 0x18) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() getresgid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f00000002c0)={{}, {0x1, 0x1}, [{0x2, 0x6, r2}], {0x4, 0x4}, [{0x8, 0x6, r3}, {0x8, 0x4, r4}], {0x10, 0x4}, {0x20, 0x4}}, 0x3c, 0x2) ioctl(r1, 0x8916, &(0x7f0000000000)) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x0, @broadcast}, {0x2, 0x0, @empty}, {0x2, 0x0, @local}}) ioctl(r1, 0x8936, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pause() ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) read$FUSE(r0, &(0x7f00000023c0), 0xffffffffffffff22) 04:48:44 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 899.855130] binder: BINDER_SET_CONTEXT_MGR already set 04:48:44 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SETVAL(0x0, 0x4, 0x10, &(0x7f0000000040)=0x400) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0007e8810cf001300000", @ANYRES16=r1, @ANYBLOB="030000000000000000009a263f53747ec6ee99099d203c9a020000004f84069714f415003ae052e8f2e2e95c9c240ec967880c5feb020ca0b41640e5af4131c5920d5b5973e988c17b304af4c54f3ec8629aef671a05ba9a30ebe5e867a44ff6c3669b8c74c236ea5462c3617df6e13abcbc55e1"], 0x1c}}, 0x0) [ 899.875445] binder: 1986:1991 ioctl 40046207 0 returned -16 04:48:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 899.962056] autofs4:pid:2000:autofs_fill_super: called with bogus options [ 899.991110] autofs4:pid:2004:autofs_fill_super: called with bogus options 04:48:44 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00\xa2\xcdl\xac\xa4\x19\x15\x87\x84u\f\x01\xc0\xef\x18\xf6\xc8\xc6*\x9d\xedG0\x90`\xcf}\xf4a\x1dGk6\xc4\xbe\xa2\xfa4\xe6\t\x93\x10jBh\xbdT\xcf=Y\x89\xce\xf7\xb1$G\xd2\x03\xa9\x1fx\xcb;p\x01w\xd7q\x99\n\x06\xca\xc48\xa9\xf0_\xcdj]\n\x99\\0\rI\xb6\x153\x9a\xb7y\"\xf2\x13\xdd\xf1\xee\xff^\xcd\x8d\xd0U\xa8\xd9\t\xa8{\xae\xbd\x8d\xd3\xce\xa9A\xee7\x92\";.\xa6\x0f\xbd\x90=\xc91#\x7f\xf3\xb7\xb8\x1b\xb9\xa2\x10\xcamoF4\x1d\r6YQ;,\\\xf6\xd6\x19DK\xda\xd8\x90\x93U\xb1%\xfb\x94\x81*\b\xaf\xac\xf0?', 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0) close(r1) r2 = openat$cgroup_ro(r0, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/61, 0x3d}}], 0x1, 0x0, 0x0) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000000)={0x9, 0x0, 0x2}) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000140)=""/47, 0xfffffffffffffed2}, {&(0x7f0000000080)=""/7, 0x7}, {&(0x7f0000000180)=""/16, 0xa}], 0x3) [ 900.070940] binder: BINDER_SET_CONTEXT_MGR already set 04:48:44 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x0, &(0x7f00000002c0)=""/77, 0xfffffe37}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r2 = dup(r0) ioctl$KIOCSOUND(r2, 0x4b2f, 0x100000001) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x24, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 04:48:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:44 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x1) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$SIOCAX25GETINFO(r0, 0x89ed, &(0x7f00000002c0)) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x2) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000280)=0x10) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$overlay(0x40000c, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="7570705ebe4c29c98c3e3055bd10b8de176572646972392e2f66696c65302c6c6f7765726469723d000066696c65302c770100"]) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f0000000040)) [ 900.095453] binder: 2009:2011 ioctl 40046207 0 returned -16 [ 900.115085] binder: BINDER_SET_CONTEXT_MGR already set [ 900.121238] binder: 2009:2011 ioctl 40046207 0 returned -16 [ 900.201898] binder: send failed reply for transaction 1794 to 1986:1988 [ 900.223674] binder_transaction: 20 callbacks suppressed [ 900.223692] binder: 2022:2024 transaction failed 29201/-71, size 0-0 line 2816 [ 900.270597] overlayfs: unrecognized mount option "upp^¾L)ÉŒ>0U½¸Þerdir9./file0" or missing value [ 900.293833] overlayfs: unrecognized mount option "upp^¾L)ÉŒ>0U½¸Þerdir9./file0" or missing value [ 900.313613] binder: BINDER_SET_CONTEXT_MGR already set [ 900.318928] binder: 2022:2030 ioctl 40046207 0 returned -16 04:48:44 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f00000000c0)={'yam0\x00'}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8043, 0x0) flock(r1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)=0xfffffffffffffffc) bind$alg(r0, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x600, 'drbg_nopr_sha1\x00'}, 0x58) [ 900.356692] binder: 2022:2031 transaction failed 29189/-3, size 0-0 line 3035 [ 900.371909] device nr0 entered promiscuous mode [ 900.391047] binder: release 2022:2024 transaction 1800 out, still active [ 900.391131] binder: 2022:2024 got reply transaction with no transaction stack [ 900.398750] binder: send failed reply for transaction 1800, target dead [ 900.545938] binder: 2022:2024 transaction failed 29201/-71, size 0-0 line 2801 [ 900.580698] binder_release_work: 25 callbacks suppressed [ 900.580705] binder: undelivered TRANSACTION_ERROR: 29201 [ 900.592215] binder: undelivered TRANSACTION_ERROR: 29189 04:48:46 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:46 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x40040, 0x0) mlockall(0x7) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getpgrp(0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x228, 0x70bd2d, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4) r3 = getpgid(0x0) r4 = syz_open_procfs(r3, &(0x7f00000000c0)='net/nfsfs\x00') sendfile(r1, r4, 0x0, 0x80000001) 04:48:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:46 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) read$eventfd(r0, &(0x7f0000000000), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) epoll_pwait(r0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x7f, &(0x7f0000000100)={0x3}, 0x8) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) read$FUSE(r0, &(0x7f0000000200), 0x1000) 04:48:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x44, 0x80000000, 0x4, 0xfff, 0x15, 0x0, 0x3, 0x2, 0x0, 0x17be, 0x200, 0x71}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000001c0)=0x5) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000080)=0x100) ioctl$TIOCSTI(r0, 0x5412, 0x6) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)={0xffffffdb, 0xfffffffffffffffe, 0x0, 0x0, 0x16, 0x8, 0x0, 0x0, 0x0, 0x8, 0x2}) 04:48:46 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 902.334490] binder_transaction: 2 callbacks suppressed [ 902.334506] binder: 2043:2049 got reply transaction with bad transaction stack, transaction 1805 has target 2043:0 04:48:46 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vhci\x00', 0x2) writev(r0, &(0x7f0000000680)=[{&(0x7f0000000600)='l', 0x1}], 0x1) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000040)={0x10000, 0x8, 0x4, 0xdb, 0x3, 0x1ff}) [ 902.403219] binder: 2043:2049 transaction failed 29201/-71, size 0-0 line 2816 [ 902.421955] binder_alloc_mmap_handler: 4 callbacks suppressed [ 902.421976] binder_alloc: binder_alloc_mmap_handler: 2043 20001000-20004000 already mapped failed -16 [ 902.450315] binder: BINDER_SET_CONTEXT_MGR already set [ 902.466000] binder: 2043:2049 ioctl 40046207 0 returned -16 [ 902.478830] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 902.478839] binder_alloc: 2043: binder_alloc_buf, no vma [ 902.498112] binder: release 2043:2049 transaction 1805 out, still active [ 902.506828] binder: 2043:2059 transaction failed 29189/-3, size 0-0 line 3035 [ 902.520265] binder_release_work: 3 callbacks suppressed [ 902.520271] binder: undelivered TRANSACTION_COMPLETE [ 902.542653] binder: undelivered TRANSACTION_ERROR: 29201 04:48:47 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x2, 0x2000) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000001d40)=""/217) futex(&(0x7f00000006c0)=0x2, 0x0, 0x2000002, &(0x7f00000004c0)={0x0, 0x989680}, 0x0, 0x2) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x3c) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000140), 0x10) setsockopt(r2, 0x65, 0x1, &(0x7f0000000700)="3b3561ac00814a4548c78d250bdd795fd74ffc69a3565b45f64e53148f3f1ba2f9ef4cd9bc9accca5a9e66aa66083c540e1c390ef3733d2d4aa8d18ac54b2a11459a84cd69778e626bf2180598cf27123f9e627bf4e0467e04f91dd4c9824be1fec0ce58dd168688e6c45a2d8381f4c9a4dfa0fdbb9c9f9e0ffe482aabc46830685fd52c4413cd4d9929999530dec36e01bfcd34099fbe33339b575ff07af0ec8c1a3c4470c103362070b6230923b6a576f83bd964cdafeaeec9e341d82f90054773b4bb1886feeab2b03ec217b9c7e1caba03da6c718f16cbf30431abe8bb25295fb02cdf4fe3a04f89cf9cc5152d48d92b3f8c9e53beb90474488822da8c6ff25760c06fa435f9d0854024945f872c2d61c78c2db8a5d40e8acbd8c00e008aa50d36c09ac673fb47850a7bf8c3394a2e8112c10c10b5c9a7ee6d364ca52a1e1422e433bb020f2e74eb600033d1af7f5e2bd98ba21417e6daa73284c958ac353dc9add51e9b3ce7558cd3f47417d148444ac3a4012a393f87f3edfe83a68f9c5c80fa3e3605150e199f0443b908f11934f96745dcdf9079b275908bdfa7f470c6583c2f17d00f865afa83a0161d65624de63dfa09e359e1eb0000000100000000b8726651fba34a330eb4d117571008a9634576a1d3e245355788c524a072e1dd361370769a3250291fbb1c0015bbe190d93320e4cf2bfe640f9082a4a33524291403c723ff866b37e651eb32b16803511b5e4ca7afa48ff5dba1559deb21413bee6d818b648d60e299d9ef9e39846d771f4eb6e2fbefac6290fc2cbb1af648451675a870b77b956db74420005e9393", 0x250) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x4, 0x4400) r4 = accept4$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x80000) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f0000000980)=ANY=[@ANYBLOB="0000000040000000030000000000000000000000000000000000000000890000000000000000000000000000000000000000000000000000000000000000000000ff0f00008100000001010000000000008100000000000000080000000000000005000000000000000000000000000000000000000000000000000000000000000200000080e65d626acb7a9aad84c5eb74ff52d8000000090000000000000005000000000000001f000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000cf54de7293b654d8d8129d8855dd9184d0031ab3c7038d9243d3d92a04fa"]) ioctl$RTC_UIE_OFF(r3, 0x7004) ioctl$BLKALIGNOFF(r3, 0x127a, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000180)=0xabf) close(r2) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000380), &(0x7f0000000480)=0x8) lookup_dcookie(0x80000000, &(0x7f0000000b40)=""/4096, 0x1000) 04:48:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 902.566213] binder: undelivered TRANSACTION_ERROR: 29189 [ 902.591684] binder: send failed reply for transaction 1805, target dead [ 902.703870] binder: 2071:2073 got reply transaction with bad transaction stack, transaction 1809 has target 2071:0 [ 902.732101] binder: 2071:2073 transaction failed 29201/-71, size 0-0 line 2816 [ 902.767381] binder_alloc: binder_alloc_mmap_handler: 2071 20001000-20004000 already mapped failed -16 [ 902.799420] binder: BINDER_SET_CONTEXT_MGR already set [ 902.822503] binder: 2071:2073 ioctl 40046207 0 returned -16 [ 902.828650] binder_alloc: 2071: binder_alloc_buf, no vma [ 902.847167] binder: release 2071:2073 transaction 1809 out, still active [ 902.847349] binder: 2071:2078 got reply transaction with no transaction stack [ 902.854853] binder: 2071:2076 transaction failed 29189/-3, size 0-0 line 3035 [ 902.871053] binder: undelivered TRANSACTION_COMPLETE [ 902.885952] binder: undelivered TRANSACTION_ERROR: 29201 [ 902.891301] binder: 2071:2078 transaction failed 29201/-71, size 0-0 line 2801 [ 902.896510] binder: send failed reply for transaction 1809, target dead 04:48:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 902.938294] binder: undelivered TRANSACTION_ERROR: 29189 [ 902.941043] device nr0 entered promiscuous mode 04:48:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@getlink={0x74, 0x12, 0x400, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_PHYS_SWITCH_ID={0x14, 0x24, "522bc9667e1425b063a39a005825d8"}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x8}, @IFLA_IFALIASn={0x4}, @IFLA_OPERSTATE={0x8, 0x10, 0x10001}, @IFLA_PHYS_PORT_ID={0x24, 0x22, "df8f006994fbf5c0b449eee8ac3a10271b3e3781fb065ba59f95ef8eb092c5"}, @IFLA_IF_NETNSID={0x8, 0x2e, 0x3}]}, 0x74}}, 0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000056c0)={&(0x7f0000000200)=@ipv6_newaddr={0x2c, 0x14, 0x90b, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x14, 0x2, @dev={0xfe, 0x80, [], 0x17}}]}, 0x2c}}, 0x0) [ 902.997376] binder: undelivered TRANSACTION_ERROR: 29201 [ 903.067364] binder: 2079:2082 got reply transaction with bad transaction stack, transaction 1814 has target 2079:0 [ 903.097592] binder: 2079:2082 transaction failed 29201/-71, size 0-0 line 2816 [ 903.109333] binder_alloc: binder_alloc_mmap_handler: 2079 20001000-20004000 already mapped failed -16 [ 903.143128] binder: BINDER_SET_CONTEXT_MGR already set [ 903.148870] binder_alloc: 2079: binder_alloc_buf, no vma [ 903.163675] binder: 2079:2082 ioctl 40046207 0 returned -16 [ 903.171516] binder: 2079:2084 transaction failed 29189/-3, size 0-0 line 3035 04:48:47 executing program 5: socketpair$unix(0x1, 0x40000000000005, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/dev_snmp6\x00') openat(r2, &(0x7f0000000080)='./file0\x00', 0x0, 0x2) fchdir(r0) sendmmsg(r1, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) [ 903.201161] binder: release 2079:2082 transaction 1814 out, still active [ 903.202935] binder: 2079:2085 got reply transaction with no transaction stack [ 903.216670] binder: undelivered TRANSACTION_COMPLETE [ 903.248666] binder: undelivered TRANSACTION_ERROR: 29201 [ 903.271048] binder: send failed reply for transaction 1814, target dead [ 903.291525] binder: undelivered TRANSACTION_ERROR: 29189 [ 903.293548] device nr0 entered promiscuous mode [ 903.300264] binder: undelivered TRANSACTION_ERROR: 29201 04:48:48 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:48 executing program 5: socket$inet_tcp(0x2, 0x1, 0x0) mprotect(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x2f) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty, 0x77f980000}, 0x1c) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000500)='msdos\x00', &(0x7f0000000340)='./file0\x00', 0xe800, 0x1, &(0x7f0000000540)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x18, 0x0) r2 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x1, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000880)=""/207, 0xcf, 0x12100, &(0x7f0000000240), 0x10) sendto$unix(r2, 0x0, 0x0, 0x40881, 0x0, 0x0) fchdir(r2) r4 = open(&(0x7f0000000200)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980)={0x8, "7c70ee3800d5ab5f2036f872e0ac57cbd592bca0d671633f50a3102066d6e765f5a64731e3fb8d90d250eda2cc33b60a7ff98074cdc3f1dd1a2df26a381d95974e0925d521c6b48c3dee0d430d398884316091aff6adb6153dc3c92549957d3488efc02d6f6fb172524b095c30c1bd35aae04236bdd42694d613eb54c0b65a338c48dc4c8bad70754fc81d9928e4a1b81f9c77075258a0805b4494867247966b24a023311fd91ef3754b98d3acde6f2ef0617f123c22fccb81c11389fdfa2e21c2365aabfc8916e02151d8643ae21cab7fcbec6142186d3bb57546c106484bc4c28a48da2b75dd82aabe99464558e60cd101f6b65856fabee614d271741a68dd550c8772f06a93cf8e5c0de549c3b75a72f8a590bd50b2af5f64009c969ed7596f0192b0f98b1afac0e8c5f4c653f611b4a71776400a9ae3f18e75f856788c97195749042510735880b9bb0ccb23210832a4f1c6f134d68f8e299837c426e0c9a45d5d2c959446cc363f370c67cd01a063c91254d692fe35abee92fabda4f66d93228c979ebe036c5c2e0028ec76562d67d0919ca28258fec0ed60603142b5c57c4cfb1ea1e892d0fd2f33970142b179c415d6bea344fbcc82d133052e848a885160737c69eb02ca9f544831c8e3ffcf40cb7b415d24795fc8aaeb8e76bec262aea5e28fe5d6495c4b5895a612b1cc2122286add66356f3ecd309f970634f1b09da1507964d35575167317f13c7fd9f11af27ceea86e9a5b3494a27ba98ba38dd1fb72ef2c6163664fd8f7c946935cd4833121f505ff277c03d959d9a12f3389e9eb6701a8b29f72c20c6abb7bd8349dd2e120bdd59dca9f1a2a877f1677b59d7920ddf29b9d94f7c6879b78e31cf1b65b60fe349ef9d4976f46609ee34e33f647aafbf64f6323d18598905f2e73af75661397595b8f9c1e9a4e993946820da5378ca5b363560e95edce316e99bac6e6250efcf1cb58fdcf94c7557c2d7f763a688543462d54b64e178c2e64c6ebba356894973051907fd8de8ba908e822168b171c1707efcd9ac827e64313721876e2ff26ac34e88557a4a0dfde08eda81cf0c1465a89b68429e48966044c767563e1121db48c9b619fd7362afd15ec6aa19b28759d7977be4fbcad0cf8dd5dc5362259bd5cb5089a9d18db969afe1192571f5fcc0c4d6be281d23b9c1f9f32873c058adfa1bf57a3718686957edfd6e4b58aa959541127696d59fb2810d042ced227961eb19a424e4cf45bc6243217bb7561b7ee11f8c0b8f39480343a26f2da5fe79d5e213c01ea47155ffa91e7d7ba0bc8ccb018bd69cfe71dd8565a645d678b404a295397e83ae69dbf8505f6947a836b44823a92861124330fccd4bc4a2e20d9047bd919d82c89623caa87eb09bd584d58f42b35ef55fddc06dfb3957f3f507e5ca9b8b98947cc5bb68846755527ddf32ffa444e1c7a5654d4d377e04a9f22e1069804fdcdb251acb6bd6b32d100feb44286991d779d2b3e2b7f5cc5f8eb3ae166a3b6fb9df11e1867989a6f9b2028e4c73b4d418b51f6e870713cadafddb47a48c9a97283da214f02db3326d42438d9a7db580693ad1887f99d86bb5fafd6d07c2647fc80c2c5a1ed9ea3b95be65ca422080ddefca5b49ccd538f6bc67390f892d9e416f7e835f76dd90edc56256348d20560caeea05c0922cab60dbf0b57ddaaed6ded5a336e01485fd571dc12050461271cee347c31ac245bfee9128630dfcc43b6d88b5ba9937a6f6ab70b7d256784ff72297cfcfd0ffacd09b55fb832bf60f04d87c48c74972b9f18fa178ce4880b025d1c1097ddb929e8f7e02f1c0e03012bec0fa61a49eb1c2a50a45fc0d98b6649de325184006938e421321e8b366649d9b6ebadf77509c9d48844e80f7752fd7daaa5c938b946feaaac0d871203270a747035c7e2f697c84e792a55cbce76c0a25360f7acbeaab60627aa9c37064af75b67f46732844eb2f6b37226004afe451a9fbfbbcf7e72ade67b017e9209b5627fbe16789abd90326751a1fd1d93efc59f2650f979ba71938d784064922bee2874c4b76d5f26e39ea0a98cf175950137feff9456c88c6a295830183fae3a9c2312c25f3d81708d73488d15a587e7e7cdde3b77917eef29c8b5965c916a65c3c5a53b7313c3115d0a8bb4e16f6b80ff6f78adb756aba94ced86047562a2cd2fb25e9a4656f6359c3f2fde8b5ab38852853cbd7221cb4d59b7f0e79bd37f9ade073f62b75edbe63c13c0d02bf076d88f5b750ea640aad47ce97d6a0783398dd3fbb63734ed969470cf45200235650532224fc28caf1e36ca6b402ec4c978add40fc59f2113485875682139f8aa9aeb48d09178de919370b0cd0ebcab5e60e1b0a2fc153db0dae8e50b48561622a677d0f1afc149676f832e016e14007fb298dcb96f11a92a1ac8bd4cc7b34d659d6cd2c9817b586585e72080255b083bc84512277ffb7f561c6a7a08cd128bfe9b525da531f0bf04f11d3de102b3538835807ac0b2f4325fc6765d02d692ec82f5b338c8257029136fcd3427c09874ecc7492becdd6608eac4adf1abc3f7e08868a72e57ce4dcfc288a25af73d19f1118a9254963c1548cdca5fc7c921a7f218f8e71edd7969dfb35beae1091d7530e32236397fa9fcd232b441ff1b0177829468c198d659d247ccca4fbd58c625501e4368075d0e5e69a6f90952f5bbe48e85a303131dedf7f1a513b291598a545784e1013521877c25d6069d3a855652a4bad5b2df2e4da2de756a20e790b756dd2925ce824561e5892b5e064c7c7b996acc4e29597e0cd00956e9c57ec374714f846be7632d3075e38bead499163498810886c78a2cc73fb64fd48e186083ce911e0751b4dc63476859c2824fa532a4b1711c244619e702eeab19380aeb7b17f67fade3dcad8ddddd893a526cd5d04d8ae982c88029ec71bdd0772fd74adbdb378fc204ca411a2d8a50331516a28552be78f9725f32d1b3a6c7bdf3277c5f7e385c7ebbacc419ec7ca3c5b8f46dbefee59b6422a6b22d60527edc012f852077d925619874f7709f283e01678fed36528003a696ee431a817f34f453c143dc56b70e1f810a5380a555cc8c4fc6522ab544ce5d715caa302ebdd0aa8286b7ef5dd6dd48a8ad9566818f7509daf02db0b98b432f57f1d107ee95a86228728cab4062e27922381e1e2ee351af5e2ea0fd6d1cea70b3b8f4a50f0776fc9aa2a7d2dff6e1ea3769864104f09137b99960b69af13895d842649eacaed8ddf183beba3323640af8deb52b902c0974d685d19fc87c93eb80ad5d28e54363705ad39231d989522e94f000256bc8d93af138a45d67dad3e21fa9fb31d9327c6e71f61956d9daf4f97333112704136d3d1bf6fe0e4c002e10b684d2344300ec70fae0b50532ebace58f0e8318354a172cceacf27d01ff41cc8fef42443f62b0e15b5fcc0728630b96fb2c2b59634f4993bb1ce2eace6fb0f53e5f84bc5f58b1b66d59e3c75a98670496f105a703607211aa9e882e72f13e9fe07f0767ad4e5ac5c732b65301d8ceab36b5ff2f71958fb1b51d2e703ac506e68d4026160fd3f60440b8b8f554f1feeba5d53f71cbe60d143620f8fa779acb94c965b729207a5ab11f4a51b694c31606171da44a28d80cde296dff5724ff718d6377eb8534e616cff39af943ee4ce87b4fadded30c702d370a71072ab3e20f19b8c1b73fdbbb9c675352bb73ee85e22597fc0c439a33f5febe1629bd084af7193f8d1a1415b02ca54706711505cbae11ec6411b012cc3a3eddcfb002901b6e7565b9fbf4d605c147031888ceb590c14697d00970ce9095c6f7fee41ec6a15d7ef52dfedfff2a0d3dbb387b61232aee6ca202787038021e6aabda18e2adf6fd89aa491e65f9813d73412fbfff089752d713d7efa690ec4fc254b56908d3057f65997acf81aea589e272f8fa852849e488f1e0c0cb6cdb5f46ca92e36d39224e704850056d2e9b91909aed0f55d054e274415ecc39b8958335a14cfb0a42d7f26ef8e82592dfd03b3550b5193fba077994c682951968869574fd94976760d9bd9b334353eeda836cc8dab244e72095cc46833f02bb2f6df35601b3085664261abb67fc9ab9f27210e6827cd15ce16c55f0f7f5b8ab401f24032b19a53a9299b62ebf4a8cf7f4753d95126f008a8ce349036666de66bcaf40b27fa875efa98873e1ef9302e2a24bfe07bd1054bdf9ba9ad1b1075402f26d682833b947c762513ba5f07537bb712473184a60e04ace5adb8d982d6153b011ae0b2034adc0ff4a64e2c6561c2e0840cdab2120bc916cde9b7a92c4d332d0f83945fe55e3c8f4d93f22e7759c20241d92cca0ae5a3d06a127e5614df708cea1ad3b2f231c81460ff4c3f349c67a87135a4b67589ffce311832923f71796276e81f0537e265404c0ee06d5ed98a5ec5f8ad62db589eb585fc4627173b51fd4e897a3e8d2acbb82ec2996ac3a6823368a1e12a0536a9d1a7b2d31d80c46c292ff51395481d4f65c53fab867e27bec9156ee189d245d94877a1405dc9e1e996822ad47071a9ab36c9bfd02c41ea5ba21591793053b1b64758bae0addfcd69d169849bc1ee6ce5c08f0d3da5ecc1b6ab31e13af2fa5ce4d921163270901264a88ac6350e8fb6371663dd04146932238597258b123a8036250c190fbb3cfc6ebbf9e06c4a9053e8332c95c91a890a3d35ddd35f47e7ab606f3e345e12560e6d52243883da7b8910834042ad12e7fb3f08a0b14ef6aee22251999e6079be2ef5666d7d5ae00d161720262761da3f378c63cb151f4e94d034e9de949dfe796b905804ca555691023c30ea7cf0cb276e1e3ba65793291f8287d1064606bf5787421b9b9bfc05e9c5eac750de92519fe9e2592cd34a2ef6ec18efed5e7c13bfcfce47327cbecac358bbe6d44164849308cf91cd5ea87fa4b02ba4939e28141c7dad42714b019470d91808a8f46150677b6c90f267ecb39ef42afc95de0cbd016775c89d8213ec9d4e061e6493f237296f91abfc64176c0e885ef54af4136a724fadfe89a25d7599998acebc4a27f8fb5b26936bda5c3d5fec3373dcd9a0e99fc939641c50669adc54119582e8835575d1c57fa955cd29d870360620f91c3ff90d264013816352317ae226f7d7bad5db711f8973382f6cebd63cd519ddd08e1772649be75f64f4acc15f828dc0b305584b6dd2213194603c44e2964358d305aa97fb08568a0a955ad7a6f8d042754b4bbf2fb3414052719fd9841bef8360d1d3195c69414be882115c2c64fecdcbdaed3a2e943fdfef9a13520e41d32a787bcfe4f61e2b378d35aa70784a772cf8ebcaaeb105e4627516db2ababfcb8c11f224c3a48c86160d34d0ee59f02c31648ae4b0309b378f0bf63266967dcfb4f1cc1902f613c6d0d48915a9cf28a52b106544cde1b38ff2e2a1275fd0d3899ce7f7c6653c9017f7ac4aaa35bcb2811a8f9dbb56746b45475350e7c13d42abb5692377da7a4045ee644ce00f8699e3251d75621c82cd659ea3add277affe3ff792f7d24a3d0979ef82cfc0d409697ae2e8598854a8327f46974c901d309dc6dbe31913c59d821aa50c0fe95cc822e8f07bbb00e9a09bc9a570b9778d29308740bc336a41258d209c206f87a709aa43415da0096f7d177e509a7d625645fb098ccc45367d82235e952670ac5f82f8ced3f59fd9ee20ac75be609cc832417e807ddc40630cba4c91e0785edcb5f20b9e6dedb1ec172cd16fc034f410e9ce375ea855144aa3076317f649cf4efe4d7abf244984c4e", 0xff54}, 0x1006) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) ustat(0xffffffff, &(0x7f00000002c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = getpid() fcntl$setown(r3, 0x8, r5) setfsgid(0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000140), &(0x7f00000001c0)=0xc) sendfile(r4, r4, &(0x7f00000000c0), 0x8080fffffffe) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c) sendmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x5c00000000000000, &(0x7f00000009c0), 0x2c, &(0x7f00000000c0)}}], 0x40000000000026a, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000003c0)='security.capability\x00', &(0x7f0000000100)=@v2={0x2000000, [{0xb319, 0x100000001}, {0x0, 0xff}]}, 0x14, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x5, 0x238, 0x1ff, 0x76cf, 0x2ce}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000200)=@sack_info={r6, 0x2b, 0x1}, &(0x7f00000001c0)=0xffffffffffffff33) 04:48:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@getlink={0x74, 0x12, 0x400, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_PHYS_SWITCH_ID={0x14, 0x24, "522bc9667e1425b063a39a005825d8"}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x8}, @IFLA_IFALIASn={0x4}, @IFLA_OPERSTATE={0x8, 0x10, 0x10001}, @IFLA_PHYS_PORT_ID={0x24, 0x22, "df8f006994fbf5c0b449eee8ac3a10271b3e3781fb065ba59f95ef8eb092c5"}, @IFLA_IF_NETNSID={0x8, 0x2e, 0x3}]}, 0x74}}, 0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000056c0)={&(0x7f0000000200)=@ipv6_newaddr={0x2c, 0x14, 0x90b, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x14, 0x2, @dev={0xfe, 0x80, [], 0x17}}]}, 0x2c}}, 0x0) 04:48:48 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:48 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 903.761867] binder: 2097:2103 got reply transaction with bad transaction stack, transaction 1819 has target 2097:0 04:48:48 executing program 1: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x20000) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x100) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, 'syz0\x00', 'syz0\x00', 'syz0\x00', 0x37, 0x7, 0x4, 0x9, 0x0, 0x9, "08ada6f4f38c60ce7e27f194af23de852e9066e0f6a687cd8a2859b2deaa7136f6a65a69e9027e43a5f221ae4b823e299dc5b570ca986f"}, 0x14f) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000080)={0x0, 0x4457, 0x1}) connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @broadcast}, 0x0, 0x1, 0x1, 0x3}}, 0x2e) [ 903.832939] binder_alloc: binder_alloc_mmap_handler: 2097 20001000-20004000 already mapped failed -16 [ 903.867943] binder: BINDER_SET_CONTEXT_MGR already set [ 903.886830] binder: 2097:2103 ioctl 40046207 0 returned -16 [ 903.924925] binder: 2097:2115 got reply transaction with no transaction stack [ 903.935780] binder: release 2097:2103 transaction 1819 out, still active [ 903.959216] binder: undelivered TRANSACTION_COMPLETE [ 903.995515] binder: send failed reply for transaction 1819, target dead 04:48:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:48 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x20002}}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) 04:48:48 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 904.132927] binder: 2127:2129 got reply transaction with bad transaction stack, transaction 1823 has target 2127:0 04:48:48 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000580)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x0, 0x0) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f00000000c0)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000240)="b7f2288a945f93f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x1e) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0xbd}], 0x30}], 0x1, 0x0) recvmmsg(r2, &(0x7f0000009940)=[{{0x0, 0x0, &(0x7f0000009780)=[{&(0x7f0000001d40)=""/15, 0xf}, {&(0x7f0000009340)=""/153, 0x99}, {&(0x7f0000000180)=""/159, 0x9f}], 0x3}}], 0x1, 0x0, 0x0) ioctl$void(r0, 0xc0045878) [ 904.216662] binder_alloc: binder_alloc_mmap_handler: 2127 20001000-20004000 already mapped failed -16 [ 904.239629] device nr0 entered promiscuous mode [ 904.258168] binder: BINDER_SET_CONTEXT_MGR already set 04:48:48 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000d12000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x4) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x1, 0x4) sendmmsg$unix(r1, &(0x7f0000000000), 0x4924924924924c4, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x800, 0x10) execveat(r3, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280)=[&(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f0000000180)='trusted.overlay.redirect\x00', &(0x7f00000001c0)='trusted.overlay.redirect\x00'], &(0x7f00000003c0)=[&(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='trusted.overlay.redirect\x00', &(0x7f0000000340)='trusted.overlay.redirect\x00', &(0x7f0000000380)='trusted.overlay.redirect\x00'], 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x3) connect$unix(r0, &(0x7f0000000400)=@abs, 0x6d) [ 904.268838] binder: 2127:2129 ioctl 40046207 0 returned -16 [ 904.309078] binder: send failed reply for transaction 1823 to 2127:2129 [ 904.350733] binder: undelivered TRANSACTION_COMPLETE [ 904.439371] device nr0 entered promiscuous mode 04:48:49 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:49 executing program 1: r0 = epoll_create1(0x81000) r1 = epoll_create(0x6) r2 = epoll_create(0x6) r3 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000c7f000)) r4 = dup2(r2, r1) ioctl$SG_GET_TIMEOUT(r4, 0x2202, 0x0) 04:48:49 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:49 executing program 5: getpgrp(0xffffffffffffffff) getpgid(0x0) getpgrp(0x0) fanotify_init(0x0, 0x0) socket$packet(0x11, 0x0, 0x300) creat(&(0x7f0000000080)='./file0\x00', 0x0) socket$unix(0x1, 0x5, 0x0) pipe(&(0x7f0000000180)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x7, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) 04:48:49 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 904.954154] binder: 2156:2162 got reply transaction with bad transaction stack, transaction 1826 has target 2156:0 04:48:49 executing program 1: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r0, 0x10d, 0xbf, &(0x7f00000001c0), &(0x7f0000000080)=0x4) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) ioctl$KDDELIO(r1, 0x4b35, 0x72b) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0xc) [ 905.043168] binder_alloc: binder_alloc_mmap_handler: 2156 20001000-20004000 already mapped failed -16 [ 905.071877] binder: BINDER_SET_CONTEXT_MGR already set [ 905.087329] binder: 2156:2173 ioctl 40046207 0 returned -16 [ 905.105065] binder_alloc: 2156: binder_alloc_buf, no vma [ 905.111683] binder: release 2156:2162 transaction 1826 out, still active [ 905.136318] binder: undelivered TRANSACTION_COMPLETE 04:48:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:49 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000035ec0b7f8c96157d1dedf4c33156ed06631081ae4d2e1d1102680e78bce6a20766e53a4f8078795794", @ANYRES16=r2, @ANYBLOB="3105000000000000000009000000300003001400020073797a6b616c6c6572310000000000000800010000000000080003000000000008000500e0000002"], 0x44}}, 0x0) [ 905.180979] binder: send failed reply for transaction 1826, target dead [ 905.283280] binder: 2191:2193 got reply transaction with bad transaction stack, transaction 1830 has target 2191:0 [ 905.294136] binder_transaction: 6 callbacks suppressed [ 905.294161] binder: 2191:2193 transaction failed 29201/-71, size 0-0 line 2816 [ 905.302265] device nr0 entered promiscuous mode [ 905.311485] binder_alloc: binder_alloc_mmap_handler: 2191 20001000-20004000 already mapped failed -16 [ 905.321951] binder: BINDER_SET_CONTEXT_MGR already set 04:48:49 executing program 2: r0 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) futex(&(0x7f0000000000)=0x1, 0x3, 0x1, &(0x7f00000000c0)={r1, r2+10000000}, &(0x7f0000000100)=0x1, 0x1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x4, &(0x7f0000ad2000), &(0x7f0000000080)=0x3) [ 905.333808] binder: 2191:2193 ioctl 40046207 0 returned -16 [ 905.346522] binder_alloc: 2191: binder_alloc_buf, no vma [ 905.358927] binder: 2191:2195 transaction failed 29189/-3, size 0-0 line 3035 [ 905.376163] binder: 2191:2193 got reply transaction with no transaction stack 04:48:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:49 executing program 2: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0x1, 0x900}) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x2, 0x16, 0x5, 0x89, "69239db4f6a06ef758f1bd3137e0ff16cd9a1edf1031213835d2ab2fc9679ac8"}) clone(0x40000210a101ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCSSOFTCAR(r0, 0x40096101, 0x0) [ 905.385263] binder: release 2191:2193 transaction 1830 out, still active [ 905.392979] binder: 2191:2193 transaction failed 29201/-71, size 0-0 line 2801 [ 905.400547] binder: undelivered TRANSACTION_COMPLETE [ 905.406008] binder: send failed reply for transaction 1830, target dead [ 905.463576] device nr0 entered promiscuous mode [ 905.500246] binder: 2200:2202 got reply transaction with bad transaction stack, transaction 1835 has target 2200:0 [ 905.525768] binder: 2200:2202 transaction failed 29201/-71, size 0-0 line 2816 [ 905.541842] binder_alloc: binder_alloc_mmap_handler: 2200 20001000-20004000 already mapped failed -16 [ 905.564093] binder: BINDER_SET_CONTEXT_MGR already set [ 905.569649] binder: 2200:2202 ioctl 40046207 0 returned -16 [ 905.582340] binder_alloc: 2200: binder_alloc_buf, no vma [ 905.589547] binder: 2200:2205 transaction failed 29189/-3, size 0-0 line 3035 [ 905.606469] binder: 2200:2202 got reply transaction with no transaction stack [ 905.625072] binder: release 2200:2202 transaction 1835 out, still active [ 905.636560] binder: 2200:2202 transaction failed 29201/-71, size 0-0 line 2801 [ 905.645370] binder: undelivered TRANSACTION_COMPLETE [ 905.658469] binder_release_work: 9 callbacks suppressed [ 905.658476] binder: undelivered TRANSACTION_ERROR: 29201 [ 905.679011] binder: undelivered TRANSACTION_ERROR: 29201 [ 905.691406] binder: undelivered TRANSACTION_ERROR: 29189 [ 905.698800] binder: send failed reply for transaction 1835, target dead 04:48:50 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000300)='/dev/sg#\x00', 0x0, 0x2) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000080)=""/195, 0x200000d7}], 0x1) write$binfmt_elf32(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c460100000000000000e9bcf2791a58cab844344f2d4c78b4000000004b00000000080000000000"], 0x2a) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) getresuid(&(0x7f0000000180), &(0x7f0000000200), &(0x7f0000000240)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@multicast1}}, &(0x7f0000000280)=0xe8) r5 = getuid() getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f00000002c0)=0xe8) getresuid(&(0x7f0000000340), &(0x7f00000005c0)=0x0, &(0x7f0000000600)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0}, &(0x7f0000000680)=0xc) getresuid(&(0x7f00000006c0), &(0x7f0000000700)=0x0, &(0x7f0000000740)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000780)={0x0, 0x0}, &(0x7f00000007c0)=0xc) getresgid(&(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880)=0x0) r12 = getgid() lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r1, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000980)={{}, {0x1, 0x4}, [{0x2, 0x2, r3}, {0x2, 0x3, r4}, {0x2, 0x2, r5}, {0x2, 0x2, r6}, {0x2, 0x4, r7}, {0x2, 0x6, r8}, {0x2, 0x7, r9}, {0x2, 0x3, r10}], {0x4, 0x2}, [{0x8, 0x3, r11}, {0x8, 0x0, r12}, {0x8, 0x0, r13}], {0x10, 0x5}, {0x20, 0x7}}, 0x7c, 0x3) 04:48:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:50 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='pids.current\x00', 0x2761, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000040)={0x7, 0x70, 0x7, 0x1, 0x8, 0x0, 0x0, 0x3, 0x80a0, 0x9, 0x3, 0x1, 0x3, 0x800, 0x2, 0xdb1, 0x1000, 0x3, 0x40, 0x7, 0x1, 0x5, 0x2, 0x100000001, 0x8, 0x80000000, 0x4, 0x81, 0x100, 0x3, 0x17b1, 0x2, 0x9, 0x2, 0x0, 0xffffffff, 0x10001, 0xeb, 0x0, 0x800, 0x0, @perf_config_ext={0x7, 0xfc8b}, 0x28, 0x80000001, 0x4, 0x7, 0x3f, 0x4, 0x101}, r2, 0x3, r0, 0xa) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x4030582a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) close(r3) 04:48:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup3(r0, r0, 0x80000) getsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f00000005c0), 0x4) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept$alg(r3, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) recvmmsg(r4, &(0x7f0000001280)=[{{&(0x7f0000000ec0)=@nl=@proc, 0x34e, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x11, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1500, 0x0, &(0x7f0000001380)={0x77359400}) r5 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x9, 0x80400) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000240)=@raw={'raw\x00', 0x9, 0x3, 0x2d0, 0x150, 0x0, 0x150, 0x0, 0x150, 0x238, 0x238, 0x238, 0x238, 0x238, 0x3, &(0x7f0000000140), {[{{@uncond, 0x0, 0xe8, 0x150, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x4, 0x3ff, 0x80000000, 0x3, '\x00', 'syz0\x00', 0x5}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xff, 0x8, 0x1}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x20000, 0x0) 04:48:50 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 906.052382] binder: 2214:2220 got reply transaction with bad transaction stack, transaction 1840 has target 2214:0 [ 906.075080] binder: 2214:2220 transaction failed 29201/-71, size 0-0 line 2816 04:48:50 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000040)=0x9, 0x4) bind$alg(r0, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="9455040094000000007fffffff00288a", 0xffffffa4) r2 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r2, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000200)=""/98, 0x62}, {&(0x7f0000000280)=""/112, 0x70}], 0x2}}], 0x1, 0x0, 0x0) [ 906.126247] binder_alloc: binder_alloc_mmap_handler: 2214 20001000-20004000 already mapped failed -16 [ 906.142708] binder: BINDER_SET_CONTEXT_MGR already set [ 906.148050] binder: 2214:2220 ioctl 40046207 0 returned -16 [ 906.178766] binder_alloc: 2214: binder_alloc_buf, no vma [ 906.199995] binder: release 2214:2220 transaction 1840 out, still active [ 906.202871] binder: 2214:2233 got reply transaction with no transaction stack [ 906.210419] binder: 2214:2227 transaction failed 29189/-3, size 0-0 line 3035 [ 906.221430] binder: 2214:2233 transaction failed 29201/-71, size 0-0 line 2801 [ 906.235379] binder: undelivered TRANSACTION_COMPLETE [ 906.242810] binder: undelivered TRANSACTION_ERROR: 29201 [ 906.286179] binder: undelivered TRANSACTION_ERROR: 29189 [ 906.291679] binder: undelivered TRANSACTION_ERROR: 29201 04:48:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:50 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="02000000000000000000000000000000ae895979fb1a3093f5840efa94d4676de0bd557b36a61a64b017076abbed9668f789a5f0f824fb5b904f7c952dc0b37e9b0dd42efb2186a8d5abe010034407f04dfe1a43d3f5347031f2eb9dbda91d991e75d2bef9ca6058359685a08f80647adfb030da783dd32adef44b41cb46162704fdad31ecc1e8dfcc96b5fe0e6d07"]}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000250000000000000200010000000000000000020000627c05000500000000000a00000000000000ff1700000000000000000000000001170000000000000000"], 0x80}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=ANY=[@ANYBLOB="020a00000700000000000000e200000005001a0000b60700041727fbb0fde73939ca5dbb8a07000000000000001e3ed5ff5d6900000006d100ff"], 0x3a}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x0) [ 906.326488] binder: send failed reply for transaction 1840, target dead 04:48:50 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='pids.current\x00', 0x2761, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000040)={0x7, 0x70, 0x7, 0x1, 0x8, 0x0, 0x0, 0x3, 0x80a0, 0x9, 0x3, 0x1, 0x3, 0x800, 0x2, 0xdb1, 0x1000, 0x3, 0x40, 0x7, 0x1, 0x5, 0x2, 0x100000001, 0x8, 0x80000000, 0x4, 0x81, 0x100, 0x3, 0x17b1, 0x2, 0x9, 0x2, 0x0, 0xffffffff, 0x10001, 0xeb, 0x0, 0x800, 0x0, @perf_config_ext={0x7, 0xfc8b}, 0x28, 0x80000001, 0x4, 0x7, 0x3f, 0x4, 0x101}, r2, 0x3, r0, 0xa) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x4030582a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) close(r3) [ 906.400445] binder: 2239:2240 got reply transaction with bad transaction stack, transaction 1845 has target 2239:0 [ 906.440517] binder: 2239:2240 transaction failed 29201/-71, size 0-0 line 2816 [ 906.477022] binder_alloc: binder_alloc_mmap_handler: 2239 20001000-20004000 already mapped failed -16 [ 906.522637] binder: BINDER_SET_CONTEXT_MGR already set [ 906.538742] binder: 2239:2240 ioctl 40046207 0 returned -16 [ 906.567174] binder_alloc: 2239: binder_alloc_buf, no vma [ 906.589136] binder: 2239:2240 got reply transaction with no transaction stack [ 906.592746] binder: release 2239:2240 transaction 1845 out, still active [ 906.609357] binder: undelivered TRANSACTION_COMPLETE 04:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 906.622935] binder: undelivered TRANSACTION_ERROR: 29201 [ 906.641069] binder: undelivered TRANSACTION_ERROR: 29201 [ 906.656840] binder: undelivered TRANSACTION_ERROR: 29189 04:48:51 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="02000000000000000000000000000000ae895979fb1a3093f5840efa94d4676de0bd557b36a61a64b017076abbed9668f789a5f0f824fb5b904f7c952dc0b37e9b0dd42efb2186a8d5abe010034407f04dfe1a43d3f5347031f2eb9dbda91d991e75d2bef9ca6058359685a08f80647adfb030da783dd32adef44b41cb46162704fdad31ecc1e8dfcc96b5fe0e6d07"]}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000250000000000000200010000000000000000020000627c05000500000000000a00000000000000ff1700000000000000000000000001170000000000000000"], 0x80}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=ANY=[@ANYBLOB="020a00000700000000000000e200000005001a0000b60700041727fbb0fde73939ca5dbb8a07000000000000001e3ed5ff5d6900000006d100ff"], 0x3a}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x0) [ 906.672257] binder: send failed reply for transaction 1845, target dead [ 906.754158] binder: BINDER_SET_CONTEXT_MGR already set [ 906.770463] binder: 2251:2252 ioctl 40046207 0 returned -16 [ 906.770605] binder_alloc: 2251: binder_alloc_buf, no vma [ 906.789901] device nr0 entered promiscuous mode [ 906.796004] binder: release 2251:2252 transaction 1850 out, still active [ 906.803713] binder: undelivered TRANSACTION_ERROR: 29201 [ 906.821093] binder: send failed reply for transaction 1850, target dead 04:48:51 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') r1 = openat$cgroup_ro(r0, &(0x7f00000003c0)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0) perf_event_open(&(0x7f0000000040)={0x7, 0x70, 0x7, 0x1, 0x8, 0x0, 0x0, 0x3, 0x80a0, 0x9, 0x3, 0x1, 0x3, 0x800, 0x2, 0xdb1, 0x1000, 0x3, 0x40, 0x7, 0x1, 0x5, 0x2, 0x100000001, 0x8, 0x80000000, 0x4, 0x81, 0x100, 0x3, 0x17b1, 0x2, 0x9, 0x2, 0x0, 0xffffffff, 0x10001, 0xeb, 0x0, 0x800, 0x0, @perf_config_ext={0x7, 0xfc8b}, 0x28, 0x80000001, 0x4, 0x7, 0x3f, 0x4, 0x101}, r2, 0x3, r0, 0xa) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x4030582a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) r3 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) close(r3) 04:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:51 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r3 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r3) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x7530}, 0x10) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141046, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x384, 0x4) ftruncate(r4, 0x2007fff) sendfile(r2, r4, 0x0, 0x8000fffffffe) 04:48:51 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000440)='/dev/sequencer2\x00', 0x201000000001, 0x0) setsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001bc0)='/dev/mixer\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x6, 0x0, @perf_bp={0x0}, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000cfd000/0x4000)=nil, 0x4000, 0x0, 0x31, 0xffffffffffffffff, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000840)=ANY=[], 0x0) write$nbd(r0, &(0x7f0000000140)={0x67446698, 0x1, 0x0, 0x4, 0x4, "841ac0dfd77f01732bd41c4d68e8a42a7992af4b0d14dbd4cb7635dca3e5df0b64ef05cc246270c6a595b9e63dabb0ba7b7ef3bccff617f9138eea49def28b36c8822093beb589eb70397bf2d2e5a3743656645fb9d9a27e679ab78ec1665114bce0d27f130542277edf30c7894e041492f0bc75e8afe338781dd3d3eb3b88d7ce39d5da331b1fbc0e21d6978b3ed3509f766a"}, 0xa3) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001c40)={0xa4, r2, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0xa4}}, 0x1) socket$unix(0x1, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000200)=0x1, 0x4) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r3) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x40242, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) 04:48:51 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) 04:48:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d03, 0x1]}) ioctl$KVM_SET_XCRS(r3, 0x4040ae9e, &(0x7f0000000300)=ANY=[@ANYBLOB="074dab2476d9e835"]) [ 907.223060] binder: BINDER_SET_CONTEXT_MGR already set [ 907.239736] binder_alloc: 2263: binder_alloc_buf, no vma [ 907.257090] binder: 2263:2272 ioctl 40046207 0 returned -16 04:48:51 executing program 2: capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000100)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000140)='sit0\x00') 04:48:51 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r1 = open$dir(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) r2 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x1, 0x0) ioctl$TIOCMBIS(r2, 0x5416, &(0x7f0000000140)=0xfe) fcntl$notify(r1, 0x402, 0x21) exit(0x0) getdents(r1, 0x0, 0x7ee07c47367e5699) epoll_create(0x3) 04:48:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 907.347732] binder: send failed reply for transaction 1854 to 2263:2269 [ 907.471715] binder_transaction: 2 callbacks suppressed [ 907.471731] binder: 2288:2290 got reply transaction with bad transaction stack, transaction 1858 has target 2288:0 [ 907.491959] binder_alloc_mmap_handler: 2 callbacks suppressed [ 907.491977] binder_alloc: binder_alloc_mmap_handler: 2288 20001000-20004000 already mapped failed -16 [ 907.513541] binder: BINDER_SET_CONTEXT_MGR already set [ 907.519505] binder_alloc: 2288: binder_alloc_buf, no vma [ 907.524495] device nr0 entered promiscuous mode [ 907.525676] binder: 2288:2290 ioctl 40046207 0 returned -16 04:48:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/igmp\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) r2 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='fuseblk\x00', 0x80, &(0x7f0000000200)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1f}}], [{@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'net/igmp\x00'}}]}}) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) 04:48:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 907.579051] binder: send failed reply for transaction 1858 to 2288:2290 [ 907.596165] binder_release_work: 2 callbacks suppressed [ 907.596244] binder: undelivered TRANSACTION_COMPLETE 04:48:52 executing program 5: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@nfc_llcp, &(0x7f0000000080)=0x80) clone(0x802182001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000005800)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}}}, &(0x7f0000005900)=0xe8) r3 = dup3(r0, r1, 0x0) ioctl$VT_ACTIVATE(r3, 0x5606, 0xaf4) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d030100000000009500000000000000712600000000000035060000ff000000bf25000000000000070500000e0000000f65000000000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d43010000000000950000000000000061540000000000006b25000000000000070500000e0000000f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], r2}, 0x48) syz_open_dev$midi(&(0x7f0000000340)='/dev/midi#\x00', 0x0, 0x200000) exit(0xb0ffffff00000008) bind$netlink(0xffffffffffffffff, &(0x7f0000000180), 0xc) keyctl$instantiate(0xc, 0x0, &(0x7f0000000280)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'GPL\x00'}, 0x2b, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r3, 0x80605414, &(0x7f0000000380)=""/165) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000440)={0x0, 0x0, 0xffffffffffffffff}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000640)={r4, 0x20, &(0x7f00000005c0)=[@in={0x2, 0x0, @rand_addr=0x100000000}, @in={0x2, 0x0, @remote}]}, &(0x7f0000000680)=0x10) connect$vsock_stream(r3, &(0x7f00000000c0)={0x28, 0x0, 0x2710, @hyper}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000100), 0x1c) [ 907.724672] binder: 2302:2303 got reply transaction with bad transaction stack, transaction 1862 has target 2302:0 [ 907.799728] binder: BINDER_SET_CONTEXT_MGR already set [ 907.818260] binder: 2302:2303 ioctl 40046207 0 returned -16 04:48:52 executing program 5: recvmsg$kcm(0xffffffffffffffff, &(0x7f00000025c0)={&(0x7f0000002240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x1ff, &(0x7f0000000180), 0x0, &(0x7f00000024c0)=""/206, 0xce}, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$link(0x8, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='comm\x00') r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000440)="585ccbe4ed83b8361f000000000000002206297b6897b66147b3c7218a9169a85ea0bdc9e1587a050000000000f1ff42e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d25500200000035c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5a7d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40000e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0xc0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) ioperm(0xa477, 0xd0f, 0x4) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r3, r2, r2}, &(0x7f0000000240)=""/240, 0xf0, 0x0) vmsplice(r1, &(0x7f0000000500)=[{&(0x7f0000000400)="f433a48684fe6e1f41e24f0d5d2bc8d98f9bd0c02b897adeb517d3bf95f4eba93c5a2fbe331e6be66a8b264dfcf70ea007da22fcad", 0x35}], 0x1, 0x1) preadv(r1, &(0x7f00000017c0), 0xef, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net\x00') fstat(r0, &(0x7f0000000840)) pwrite64(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[]}}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000600)=ANY=[@ANYBLOB="0000810090c0965f35cde5641d23d484bdf86f3ac8d46e1e5d4594dfe2f3f9f72d68a9de6bfd5caa949d424004732c90f343f9b69a62ab2f0130fc0ef314c4f0b2e8a6d325010304d73aa73016334cc9f3f0208788a38277c90eef6156bbae806e5fb98197183990955414ede9872c7ae4ea8aa2fda36e469fd587753729a6fc3c063976da164518df03fbea706843a2576869fa7565d069cd2ebb5fa4274ad9195009e39d397c9121e4f95fa472fe462e7352da8f6bfaf75fa27fa3cfc4d329ecbfdbc5d8ad6c2d257c1c01e0c8b13fcbc904d303432a46b35e542846c02589fce1c556cdef529a12b5e27d2e821edc73c38959bf4d6dd745bc4c28bd94512a520953ab7f2315f4fe7fd79d7388677a02f4ba299daf23be36efa656a691c5cc06b34fae1ed091033eb041"], 0x1) [ 907.850913] binder_alloc: binder_alloc_mmap_handler: 2302 20001000-20004000 already mapped failed -16 [ 907.961239] binder_alloc: 2302: binder_alloc_buf, no vma [ 908.018166] binder: 2302:2303 got reply transaction with no transaction stack [ 908.018187] binder: release 2302:2303 transaction 1862 out, still active [ 908.056641] binder: undelivered TRANSACTION_COMPLETE 04:48:52 executing program 4: getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@empty, @in=@multicast1}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @multicast2}}}, &(0x7f0000000100)=0xe8) getuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@mcast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000240)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@remote, @in=@loopback}}, {{@in=@remote}, 0x0, @in6}}, &(0x7f0000000380)=0xe8) r1 = geteuid() fstat(0xffffffffffffffff, &(0x7f00000003c0)) geteuid() stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r1, r2, r0) socket$caif_seqpacket(0x25, 0x5, 0x0) [ 908.073045] binder: send failed reply for transaction 1862, target dead 04:48:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:52 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) exit_group(0x1000000c29) fstat(r0, &(0x7f00000032c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000005dc0)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000002e80)=0xe8) getegid() fstat(r0, &(0x7f0000003340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fsetxattr$system_posix_acl(r0, &(0x7f0000001440)='system.posix_acl_default\x00', &(0x7f0000005ec0)={{}, {0x1, 0x2}, [{0x2, 0x0, r1}, {0x2, 0x2, r2}], {0x4, 0x6}, [{0x8, 0x2}, {0x8, 0x4, r3}, {0x8, 0x4, r4}], {0x10, 0x4}, {0x20, 0x7}}, 0x4c, 0x1) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x80045510, 0x0) r5 = socket$inet(0x2, 0x80001, 0x84) shutdown(r5, 0x1) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) recvmmsg(r5, &(0x7f0000007a80)=[{{&(0x7f00000000c0)=@l2, 0x80, &(0x7f0000000040)=[{&(0x7f0000000200)=""/173, 0xad}, {&(0x7f00000002c0)=""/191, 0xbf}, {&(0x7f0000000140)=""/85, 0x55}, {&(0x7f0000000380)=""/4096, 0x1000}], 0x4, &(0x7f0000001380)=""/32, 0x20}}, {{&(0x7f00000013c0)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001480)=""/236, 0xec}], 0x1}, 0x7}, {{&(0x7f00000015c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)=""/127, 0x7f}, {&(0x7f00000026c0)=""/50, 0x32}, {&(0x7f0000002700)=""/119, 0x77}, {&(0x7f0000002780)=""/145, 0x91}, {&(0x7f0000002840)=""/156, 0x9c}, {&(0x7f0000002900)=""/156, 0x9c}], 0x7, &(0x7f0000002a40)=""/236, 0xec}, 0x4}, {{&(0x7f0000002b40)=@x25, 0x80, &(0x7f00000030c0)=[{&(0x7f0000002bc0)=""/175, 0xaf}, {&(0x7f0000002c80)=""/237, 0xed}, {&(0x7f0000002e00)=""/106, 0x6a}, {&(0x7f0000002ec0)=""/71, 0x47}, {&(0x7f0000002f40)=""/96, 0x60}], 0x5, &(0x7f0000003140)=""/132, 0x84}, 0x3}, {{&(0x7f0000003200)=@x25={0x9, @remote}, 0x80, &(0x7f0000003640)=[{&(0x7f0000003280)=""/36, 0x24}, {&(0x7f00000033c0)=""/93, 0x5d}, {&(0x7f0000003440)=""/44, 0x2c}, {&(0x7f0000003480)=""/82, 0x52}, {&(0x7f0000003500)=""/167, 0xa7}, {&(0x7f00000035c0)=""/33, 0x21}, {0x0}], 0x7}, 0xf93}, {{&(0x7f0000003740)=@generic, 0x80, &(0x7f0000004a80)=[{&(0x7f00000037c0)=""/50, 0x32}, {&(0x7f0000003800)=""/210, 0xd2}, {&(0x7f0000003900)=""/58, 0x3a}, {0x0}, {&(0x7f0000003980)=""/18, 0x12}, {&(0x7f00000039c0)=""/136, 0x88}, {&(0x7f0000003a80)=""/4096, 0x1000}], 0x7}, 0x4}, {{0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000004b00)=""/108, 0x6c}, {&(0x7f0000004b80)=""/42, 0x2a}, {&(0x7f0000004bc0)=""/4096, 0x1000}, {&(0x7f0000005bc0)=""/149, 0x95}, {&(0x7f0000005c80)=""/12, 0xc}], 0x5, &(0x7f0000005d40)=""/77, 0x4d}, 0xe935}, {{&(0x7f00000072c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007400)=""/120, 0x78}, {&(0x7f0000007480)=""/75, 0x4b}, {&(0x7f0000007500)=""/177, 0xb1}, {&(0x7f0000007fc0)=""/4096, 0x1000}], 0x4, &(0x7f0000007640)=""/59, 0x3b}, 0x7}], 0x8, 0x2, 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xfffffffffffffffc}, 0x8) sendmsg(r5, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r5, 0x84, 0x77, 0x0, 0x0) close(r5) 04:48:52 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 908.233427] binder: 2320:2323 got reply transaction with bad transaction stack, transaction 1867 has target 2320:0 [ 908.264837] binder_alloc: binder_alloc_mmap_handler: 2320 20001000-20004000 already mapped failed -16 [ 908.275160] binder: BINDER_SET_CONTEXT_MGR already set 04:48:52 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x200000007) write$cgroup_int(r3, &(0x7f0000000000)=0x1, 0xfdef) [ 908.281358] binder: 2320:2323 ioctl 40046207 0 returned -16 [ 908.297532] binder_alloc: 2320: binder_alloc_buf, no vma [ 908.342180] binder: release 2320:2323 transaction 1867 out, still active [ 908.342620] binder: 2320:2331 got reply transaction with no transaction stack [ 908.371010] binder: undelivered TRANSACTION_COMPLETE [ 908.406251] binder: send failed reply for transaction 1867, target dead 04:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:53 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000340)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) keyctl$link(0x8, r1, r2) fsetxattr$security_smack_entry(r0, &(0x7f0000000000)='security.SMACK64IPOUT\x00', &(0x7f0000000040)='\x00', 0x1, 0x1) 04:48:53 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x400000, 0x0) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000340)=0x40) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x4000, 0x21) connect$bt_sco(r4, &(0x7f00000003c0)={0x1f, {0x9, 0x1, 0x2000, 0x3, 0xc8e, 0x5}}, 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x9, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000000c0)={0x9, @sliced}) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f00000001c0)=0x63, 0x2) openat$ashmem(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ashmem\x00', 0x101542, 0x0) write$FUSE_OPEN(0xffffffffffffffff, &(0x7f0000000000)={0x20, 0x0, 0x8}, 0x20) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 908.653983] binder: 2343:2350 got reply transaction with bad transaction stack, transaction 1872 has target 2343:0 [ 908.681538] binder_alloc: binder_alloc_mmap_handler: 2343 20001000-20004000 already mapped failed -16 [ 908.696748] binder: BINDER_SET_CONTEXT_MGR already set [ 908.707926] binder: 2343:2350 ioctl 40046207 0 returned -16 [ 908.719379] binder_alloc: 2343: binder_alloc_buf, no vma 04:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 908.752255] binder: release 2343:2350 transaction 1872 out, still active [ 908.752700] binder: 2343:2357 got reply transaction with no transaction stack [ 908.760759] binder: undelivered TRANSACTION_COMPLETE [ 908.790585] binder: send failed reply for transaction 1872, target dead 04:48:53 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x0, 0x0) fremovexattr(r0, &(0x7f0000000140)=@random={'trusted.', 'vcan0\x00'}) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000040)={0x1d, r2}, 0x10) setsockopt(r1, 0x5, 0x110000000002, &(0x7f00000000c0)="c8501091a7990c7cbac5edeef8d63f23", 0x10) bind$can_raw(r1, &(0x7f0000000080), 0x10) [ 908.825203] device nr0 entered promiscuous mode 04:48:53 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r0, 0x8991, &(0x7f0000000140)={'bond0\x00@@\xea\xff\xff\x80\x00\x00\x02\x00', @ifru_names='bond_slave_1\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x180000000) r1 = syz_open_dev$media(0x0, 0x8, 0x0) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000040)=0x1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000100)) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) sendmsg$nl_netfilter(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x148}, 0xc, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="94000000100b000826bd7000fedbdf8f0700000400e92223f9be330cca1a19addb0685dddde8c7069eb9cfcbbb35d1758112fe02719944cba75f8d8a091537dc2bfdb569dc842a86020f753ca8f84f1d7b71060800aa2669a74831491dc4ee07108d2b4dce69eb92a8004692d67cb539a6d61e59617b78796c1f8e63e3c80145b21b185f26a05a70f31a91daca52146f6aa900004751aab6b8126cda5b99452e611aa798e53a0e12ce83eaa9286c2d43fe8a85f2583e66065ca944f64d79489c27bfe883dac45e1b96485759b17fec7d47e57f2ddb24d5273ffd3d64b562f82e358d7d41aaab34f2cf8286c3aa1b7404fa1e08ff7734b4b9607b77bb4ec5d547635aa0"], 0x94}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) bind(0xffffffffffffffff, &(0x7f0000000580)=@ax25={{0x3, @bcast}, [@rose, @null, @remote, @rose, @netrom, @bcast, @bcast, @null]}, 0x80) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000240)={'bond0\x00\x00\x007\x00!!\x00\x01\x00', @ifru_names='bond_slave_1\x00\xd1|\x01'}) accept$nfc_llcp(r1, &(0x7f0000000180), &(0x7f0000000200)=0x60) [ 908.897346] binder: 2360:2361 got reply transaction with bad transaction stack, transaction 1877 has target 2360:0 [ 908.911473] binder_alloc: binder_alloc_mmap_handler: 2360 20001000-20004000 already mapped failed -16 [ 908.921904] binder: BINDER_SET_CONTEXT_MGR already set [ 908.928313] binder: 2360:2361 ioctl 40046207 0 returned -16 [ 908.932783] binder_alloc: 2360: binder_alloc_buf, no vma [ 908.953717] binder: send failed reply for transaction 1877 to 2360:2361 [ 908.960673] binder: undelivered TRANSACTION_COMPLETE 04:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:53 executing program 2: r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = getpid() r2 = perf_event_open$cgroup(&(0x7f0000000200)={0x4, 0x70, 0x6, 0xffffffff, 0x1ed141fb, 0x7, 0x0, 0x1000, 0x4001, 0x6, 0x81, 0x1, 0x200, 0xdbc, 0x4, 0x0, 0x10001, 0x8, 0xffff, 0x1, 0x2, 0x7, 0x5d, 0x7, 0x4, 0x8001, 0x8000, 0x9, 0xff, 0x3f5, 0x0, 0xf3, 0xc000, 0x8, 0x7fffffff, 0x0, 0xff, 0x1, 0x0, 0x80000001, 0x4, @perf_config_ext={0x10000, 0x7}, 0x800, 0xffffffffffff7fff, 0x6, 0xa, 0x5, 0x2, 0x5}, 0xffffffffffffff9c, 0xa, 0xffffffffffffff9c, 0xa) recvmmsg(r0, &(0x7f00000026c0)=[{{&(0x7f0000000280)=@ax25={{0x3, @netrom}, [@null, @rose, @netrom, @netrom, @null, @rose, @netrom, @default]}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000300)=""/32, 0x20}], 0x1, &(0x7f0000000380)=""/190, 0xbe}, 0x100}, {{&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000700)=[{&(0x7f00000004c0)=""/109, 0x6d}, {&(0x7f0000000540)=""/90, 0x5a}, {&(0x7f00000005c0)=""/64, 0x40}, {&(0x7f0000000600)=""/240, 0xf0}], 0x4}, 0x10000}, {{&(0x7f0000000740)=@can, 0x80, &(0x7f0000000a80)=[{&(0x7f00000007c0)=""/171, 0xab}, {&(0x7f0000000880)=""/194, 0xc2}, {&(0x7f0000000980)=""/26, 0x1a}, {&(0x7f00000009c0)=""/80, 0x50}, {&(0x7f0000000a40)=""/4, 0x4}], 0x5, &(0x7f0000000b00)=""/158, 0x9e}, 0x100}, {{&(0x7f0000000bc0)=@ax25={{}, [@null, @null, @null, @null, @bcast, @bcast, @remote, @default]}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000c40)=""/24, 0x18}, {&(0x7f0000000c80)=""/204, 0xcc}, {&(0x7f0000000d80)=""/21, 0x15}, {&(0x7f0000000dc0)=""/104, 0x68}], 0x4, &(0x7f0000000e80)=""/190, 0xbe}, 0x20}, {{&(0x7f0000000f40)=@rc, 0x80, &(0x7f0000002380)=[{&(0x7f0000000fc0)=""/182, 0xb6}, {&(0x7f0000001080)=""/124, 0x7c}, {&(0x7f0000001100)=""/113, 0x71}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/215, 0xd7}, {&(0x7f0000002280)=""/113, 0x71}, {&(0x7f0000002300)=""/101, 0x65}], 0x7, &(0x7f0000002400)=""/27, 0x1b}, 0x9}, {{&(0x7f0000002440)=@ax25={{}, [@bcast, @remote, @null, @bcast, @netrom, @default, @netrom, @netrom]}, 0x80, &(0x7f0000002680)=[{&(0x7f00000024c0)=""/220, 0xdc}, {&(0x7f00000025c0)=""/132, 0x84}], 0x2}, 0x21}], 0x6, 0x40, &(0x7f0000002840)={0x0, 0x1c9c380}) r4 = syz_open_dev$dspn(&(0x7f00000028c0)='/dev/dsp#\x00', 0x8, 0x0) write$P9_RLOCK(r4, &(0x7f0000002900)={0x8, 0x35, 0x2, 0x3}, 0x8) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r3, 0x114, 0xa, &(0x7f0000002880), 0x1) perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0x100000000, 0x6, 0x80, 0x5, 0x0, 0x3, 0x820, 0x8, 0x3ff, 0x0, 0x703, 0x400, 0xff, 0x4af, 0x1, 0xffffffff, 0xa019ebb, 0x52e, 0x19000000000000, 0x1, 0xfffffffffffff573, 0x9, 0x3, 0x7ff, 0x100, 0xff, 0xb, 0xffff, 0x8, 0x2, 0x20, 0xfffffffffffffe00, 0x80000001, 0x5, 0x0, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000140), 0x6}, 0x8, 0x4, 0x4a2b, 0x0, 0x2, 0x20, 0x7}, r1, 0x8, r2, 0x8) bind$can_raw(r0, &(0x7f0000010ff0), 0x10) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x10180, 0x14) getpeername$ax25(r5, &(0x7f0000000080)={{0x3, @netrom}, [@bcast, @default, @netrom, @default, @bcast, @rose, @bcast, @default]}, &(0x7f0000000100)=0x48) bind$can_raw(r0, &(0x7f0000000040), 0x10) [ 909.004793] device nr0 entered promiscuous mode [ 909.021371] bond0: Releasing backup interface bond_slave_1 [ 909.076580] binder: 2370:2372 got reply transaction with bad transaction stack, transaction 1881 has target 2370:0 [ 909.104563] binder_alloc: binder_alloc_mmap_handler: 2370 20001000-20004000 already mapped failed -16 [ 909.120283] binder: BINDER_SET_CONTEXT_MGR already set 04:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 909.120290] binder_alloc: 2370: binder_alloc_buf, no vma [ 909.133678] binder: 2370:2372 ioctl 40046207 0 returned -16 [ 909.139098] binder: release 2370:2372 transaction 1881 out, still active [ 909.147007] binder: undelivered TRANSACTION_COMPLETE [ 909.160544] binder: send failed reply for transaction 1881, target dead [ 909.244295] binder: 2378:2379 got reply transaction with bad transaction stack, transaction 1885 has target 2378:0 [ 909.272619] binder_alloc: binder_alloc_mmap_handler: 2378 20001000-20004000 already mapped failed -16 [ 909.282205] binder: BINDER_SET_CONTEXT_MGR already set [ 909.295044] binder: 2378:2379 ioctl 40046207 0 returned -16 [ 909.322787] binder_alloc: 2378: binder_alloc_buf, no vma [ 909.328090] binder: release 2378:2379 transaction 1885 out, still active [ 909.337931] binder: undelivered TRANSACTION_COMPLETE 04:48:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 909.351353] binder: send failed reply for transaction 1885, target dead [ 909.448385] binder: 2382:2383 got reply transaction with bad transaction stack, transaction 1889 has target 2382:0 [ 909.472180] binder_alloc: binder_alloc_mmap_handler: 2382 20001000-20004000 already mapped failed -16 [ 909.489319] binder: BINDER_SET_CONTEXT_MGR already set [ 909.495621] binder: 2382:2383 ioctl 40046207 0 returned -16 [ 909.501999] binder_alloc: 2382: binder_alloc_buf, no vma [ 909.516750] binder: release 2382:2383 transaction 1889 out, still active [ 909.531996] binder: undelivered TRANSACTION_COMPLETE [ 909.550504] binder: send failed reply for transaction 1889, target dead 04:48:54 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 909.645049] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 909.679079] bond0: Releasing backup interface bond_slave_1 [ 909.823488] bond0: Enslaving bond_slave_1 as an active interface with an up link 04:48:54 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x90000, 0x0) accept$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0xbab0358f1ccdc544, r2, 0x2a}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000180)="cb50fb84a1825ac2837012b987f4d7a4e6de2a1750e5f4ac39e170b3debc5739da1501d09c5754794373", 0x2a}], 0x1}, 0x4000000) connect$packet(r1, &(0x7f0000000240)={0x11, 0xfd, r2, 0x1, 0x80000001, 0x6, @local}, 0x14) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080)=0x2, 0x4) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x28, 0x2, &(0x7f0000581000)={{{@in, @in6=@mcast2}}}, &(0x7f0000000000)=0xe8) 04:48:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:54 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) pwritev(r0, &(0x7f00000005c0)=[{&(0x7f0000000140)="b2a12459abd03f43c8ff805ed261b460be38644f9f4176783fd1e02b269cd3a493b632b4133ec3ab4a6501b5cffcade4b5741f361bd8ff5595a656f36fc818249d72dad827d10202a093fd572d5a91e7f719b6311c3289c7e6", 0x59}, {&(0x7f00000001c0)="5174b600344f3494b65f44d557eb6c788ab4a7fcab149c071fadfba2c5a2aebf1690ed0ef39d0c21d628a31d5b36ec07117b7166d548298cb126b4581a8c53fea0af647336cb09fb0f83af4474befc0444664ce3", 0x54}, {&(0x7f00000002c0)="0eee31b7b89797dedaf460b5ba252b963fbce66f9175914f81dd57c969a2baf3a5e72430e5472c063ccd40097a39a7d74bf7f79abc6fa08c8d091230acedd9c0d0ba5c90623ae043c979d576260ff2d3e1b7a9fe438081f73ff23b5f29f9a01c5c33a44d378f31ddff1c0b769fbf0c016d01806a9a72ef91c26c945a573b893c78bc842f4ae35747a81e86876546022da478b02208d29f920ca5c1bfe2d6d28d4bfccaa285adac8e0c7141e95ef074ecb9ca1ce9389019cb2a455b99c31f557e01d087fbf956ede0f8b0806749c46b9123d44be461810d9af462cedf521c6bf9023e1dce3d78436fff4e30291c185d3d0ece005d5d", 0xf5}, {&(0x7f00000003c0)="1a267682c8459b091b78670d3ddbcba632a956b88b391d45f0252b04a61e07c87ebee711584b6f11f9dbe832654dbb49ce1d99c20a69371007bd78d6e58f46f3eaf2c90a1ba13c42dc85c871172474678ede25c2c1ccec27dbda12a0525ff0d45f9baf", 0x63}, {&(0x7f0000000440)="fdeca3dcf28523c466e572fb57209f967a78ef6e7e7bb7bb480c93502d9d1d38cc88bc33ee6e6311df5f832b46af79df9a3f74f0192c98ef60e50562864ed1c40e21d5", 0x43}, {&(0x7f00000004c0)="2c043501af54ae1a7284fb2c381c3c0e6a852d0a616d26a1a89755c48cfb4195290a7044f2c618002c7a520992409333465f57a3b0f55e651dbde3a2acfbd4a07a07d7010abd7af27cc5f74421d340206fd0769b9d59e0182036cf8f594058c84448aef8b58fdd76b6177a30c07bbd3d6429484430e6505363a0d625659e21cdca49ccc7df0eabf504f65891e8227f058e9b39c35b498fff975292c3c12d71d0f071e245939a573d41e6aa375160340ce5d62078abf52b084c02c1fb150d92cb38ea3ecac9c0506a6308da3da9", 0xcd}], 0x6, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r2, &(0x7f00000000c0)="0600", 0x2) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="34000700030045000000000000008000"], 0x10) sendfile(r2, r2, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f000002eff0)={0x1cc, &(0x7f0000000000)=[{}]}, 0x10) [ 909.931345] device nr0 entered promiscuous mode 04:48:54 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:54 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 909.994156] binder: 2397:2398 got reply transaction with bad transaction stack, transaction 1893 has target 2397:0 [ 910.010382] binder_alloc: binder_alloc_mmap_handler: 2397 20001000-20004000 already mapped failed -16 [ 910.073296] binder: BINDER_SET_CONTEXT_MGR already set 04:48:54 executing program 1: mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vga_arbiter\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='trusted.overlay.upper\x00', &(0x7f00000014c0)={0x0, 0xfb, 0x1e, 0x0, 0x5, "fba3b4dc86d0f4459cf785bc8a3f9c3e", "d4b0c6c37da9bc6f7f"}, 0x1e, 0x3) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000001300)) listen(r0, 0x7) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x2000, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000001280)={&(0x7f0000000280)=""/4096, 0x1000000, 0x0, 0xffffffffffffffff}, 0x18) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x42000, 0x0) clone(0x20000000000a7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pread64(r3, &(0x7f0000000040)=""/38, 0x26, 0x0) nanosleep(&(0x7f00000000c0)={0x0, 0x1c9c380}, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'hwsim0\x00', {0x2, 0x4e21, @local}}) ioctl$CAPI_CLR_FLAGS(r2, 0x80044325, &(0x7f0000000080)=0x22) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') r5 = socket$inet(0x2, 0x4000000000000001, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000180)="e6", 0x1}], 0x1) write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="39000000060000000000000000000000000000000005000000000000000000000fe2000000000000636f726564756d705f66696c7465720000c8ce76c9b6be57366d89582b7df255b02aa68f6ae6b5"], 0x39) accept4(r2, 0x0, 0x0, 0x20000000) [ 910.098187] binder: 2397:2398 ioctl 40046207 0 returned -16 [ 910.131811] binder_alloc: 2397: binder_alloc_buf, no vma [ 910.171883] binder: release 2397:2398 transaction 1893 out, still active [ 910.185007] binder: undelivered TRANSACTION_COMPLETE [ 910.208466] binder: send failed reply for transaction 1893, target dead 04:48:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:54 executing program 1: mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vga_arbiter\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='trusted.overlay.upper\x00', &(0x7f00000014c0)={0x0, 0xfb, 0x1e, 0x0, 0x5, "fba3b4dc86d0f4459cf785bc8a3f9c3e", "d4b0c6c37da9bc6f7f"}, 0x1e, 0x3) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000001300)) listen(r0, 0x7) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x2000, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000001280)={&(0x7f0000000280)=""/4096, 0x1000000, 0x0, 0xffffffffffffffff}, 0x18) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x42000, 0x0) clone(0x20000000000a7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pread64(r3, &(0x7f0000000040)=""/38, 0x26, 0x0) nanosleep(&(0x7f00000000c0)={0x0, 0x1c9c380}, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'hwsim0\x00', {0x2, 0x4e21, @local}}) ioctl$CAPI_CLR_FLAGS(r2, 0x80044325, &(0x7f0000000080)=0x22) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') r5 = socket$inet(0x2, 0x4000000000000001, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000180)="e6", 0x1}], 0x1) write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="39000000060000000000000000000000000000000005000000000000000000000fe2000000000000636f726564756d705f66696c7465720000c8ce76c9b6be57366d89582b7df255b02aa68f6ae6b5"], 0x39) accept4(r2, 0x0, 0x0, 0x20000000) [ 910.356871] binder: 2429:2430 got reply transaction with bad transaction stack, transaction 1897 has target 2429:0 [ 910.383498] binder_transaction: 27 callbacks suppressed [ 910.383516] binder: 2429:2430 transaction failed 29201/-71, size 0-0 line 2816 [ 910.493998] binder_alloc: binder_alloc_mmap_handler: 2429 20001000-20004000 already mapped failed -16 04:48:55 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:55 executing program 1: mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vga_arbiter\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='trusted.overlay.upper\x00', &(0x7f00000014c0)={0x0, 0xfb, 0x1e, 0x0, 0x5, "fba3b4dc86d0f4459cf785bc8a3f9c3e", "d4b0c6c37da9bc6f7f"}, 0x1e, 0x3) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000001300)) listen(r0, 0x7) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x2000, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000001280)={&(0x7f0000000280)=""/4096, 0x1000000, 0x0, 0xffffffffffffffff}, 0x18) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x42000, 0x0) clone(0x20000000000a7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pread64(r3, &(0x7f0000000040)=""/38, 0x26, 0x0) nanosleep(&(0x7f00000000c0)={0x0, 0x1c9c380}, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'hwsim0\x00', {0x2, 0x4e21, @local}}) ioctl$CAPI_CLR_FLAGS(r2, 0x80044325, &(0x7f0000000080)=0x22) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') r5 = socket$inet(0x2, 0x4000000000000001, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000180)="e6", 0x1}], 0x1) write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="39000000060000000000000000000000000000000005000000000000000000000fe2000000000000636f726564756d705f66696c7465720000c8ce76c9b6be57366d89582b7df255b02aa68f6ae6b5"], 0x39) accept4(r2, 0x0, 0x0, 0x20000000) [ 910.613361] binder_alloc: 2429: binder_alloc_buf, no vma [ 910.626209] binder: BINDER_SET_CONTEXT_MGR already set [ 910.645008] binder: 2429:2432 transaction failed 29189/-3, size 0-0 line 3035 [ 910.661467] binder: release 2429:2430 transaction 1897 out, still active [ 910.671504] binder: 2429:2430 ioctl 40046207 0 returned -16 [ 910.684784] binder: undelivered TRANSACTION_COMPLETE [ 910.705354] binder_release_work: 27 callbacks suppressed [ 910.705360] binder: undelivered TRANSACTION_ERROR: 29201 [ 910.731343] binder: undelivered TRANSACTION_ERROR: 29189 [ 910.741181] binder: send failed reply for transaction 1897, target dead 04:48:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 910.760092] device nr0 entered promiscuous mode 04:48:55 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:55 executing program 5: syz_open_dev$mouse(&(0x7f00000003c0)='/dev/input/mouse#\x00', 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) pipe(&(0x7f0000000880)={0xffffffffffffffff}) seccomp(0x1, 0xa, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x3, 0x7fff, 0x99f, 0xd0e8}]}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) write$selinux_attr(r0, &(0x7f0000000000)='system_u:object_r:public_content_t:s0\x00', 0x26) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r1+30000000}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000400)="0adc1f123c123f3188b070") [ 910.837838] binder: 2444:2445 transaction failed 29201/-71, size 0-0 line 2816 [ 910.856015] binder: BINDER_SET_CONTEXT_MGR already set [ 910.875402] binder: 2444:2446 transaction failed 29189/-3, size 0-0 line 3035 [ 910.912921] binder: release 2444:2445 transaction 1901 out, still active [ 910.920443] binder: 2444:2445 ioctl 40046207 0 returned -16 [ 910.928995] binder: undelivered TRANSACTION_ERROR: 29201 [ 910.962107] binder: send failed reply for transaction 1901, target dead 04:48:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 911.003825] binder: undelivered TRANSACTION_ERROR: 29189 04:48:55 executing program 1: mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vga_arbiter\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000001440)='./file0\x00', &(0x7f0000001480)='trusted.overlay.upper\x00', &(0x7f00000014c0)={0x0, 0xfb, 0x1e, 0x0, 0x5, "fba3b4dc86d0f4459cf785bc8a3f9c3e", "d4b0c6c37da9bc6f7f"}, 0x1e, 0x3) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000001300)) listen(r0, 0x7) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x2000, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000001280)={&(0x7f0000000280)=""/4096, 0x1000000, 0x0, 0xffffffffffffffff}, 0x18) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x42000, 0x0) clone(0x20000000000a7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pread64(r3, &(0x7f0000000040)=""/38, 0x26, 0x0) nanosleep(&(0x7f00000000c0)={0x0, 0x1c9c380}, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000240)={'hwsim0\x00', {0x2, 0x4e21, @local}}) ioctl$CAPI_CLR_FLAGS(r2, 0x80044325, &(0x7f0000000080)=0x22) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') r5 = socket$inet(0x2, 0x4000000000000001, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000180)="e6", 0x1}], 0x1) write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="39000000060000000000000000000000000000000005000000000000000000000fe2000000000000636f726564756d705f66696c7465720000c8ce76c9b6be57366d89582b7df255b02aa68f6ae6b5"], 0x39) accept4(r2, 0x0, 0x0, 0x20000000) [ 911.146491] binder: 2456:2459 transaction failed 29201/-71, size 0-0 line 2816 [ 911.174945] binder: BINDER_SET_CONTEXT_MGR already set 04:48:55 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 911.201162] binder: 2456:2459 ioctl 40046207 0 returned -16 [ 911.214285] binder: 2456:2463 transaction failed 29189/-3, size 0-0 line 3035 [ 911.228089] binder: release 2456:2459 transaction 1905 out, still active [ 911.256809] binder: undelivered TRANSACTION_ERROR: 29201 [ 911.287739] binder: undelivered TRANSACTION_ERROR: 29189 [ 911.318943] binder: send failed reply for transaction 1905, target dead 04:48:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0x7ffffffffffff00c}, {0x6}]}, 0x10) r2 = dup2(r0, r1) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x14, 0x18, {0x0, @bearer=@l2={'eth', 0x3a, 'caif0\x00'}}}}}, 0x33fe0}}, 0x0) 04:48:55 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 911.410927] device nr0 entered promiscuous mode 04:48:56 executing program 5: syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f0000000080)='./file0\x00', 0x7, 0xa, &(0x7f0000000a00)=[{&(0x7f0000000100)="c2c50d66db07189b32b18620703bb6b6cbc6166fde169da700c1367cc3ab20ea871a5d1edc731a99e3a6cb7d5dc84f524241eb76c6cd1c5f820dde423e089523895a762a90585d14d93e1128a0960b967c004777b793520940f4b14d9918cf31f9fab082824ed7e3c02aadedfe1170ef5acf06f1bc7ed10a38118b73ab18f590a192c28bcf0894d5fd6b091c1f83dcf0c6afb96d71e8b17c53", 0x99}, {&(0x7f00000001c0)="b221411138e940b3bd89b1d1a9b6d31ad41892bdb1d2b7fee2055c8dce2af96a91ddd8e985f409d7ad77a4df74491307ec9c4824e5cf536b2d4c8e581dbe897b7b440d71d3dc574d", 0x48}, {&(0x7f0000000240)="b03bcccc049f53b4936e704a0b546e8e8b8fc6dd59202fe6a8f77d540b01fe2d3c55f6b47bc9ece7781f5ef7369a50d5f52bbbdf4207cd7682ac6348854d88b942c005652a4be0a81b483855e6efe1c37b8b5e7efae04bfb26c1f033", 0x5c, 0x8}, {&(0x7f0000000480)="9b0c539bc8a2079f5711541be81528bc947abd16ebf5b93652166b56fb71def5ce50fd8a26d8ed7ea59f6ac309b5102e0f27618df56da792f1a394e1e784e9e2eb8acf17b78d8a8c4880d236fd0cb0416df6d29b30f5ad39715612561890ad50420fdc82b50792cc34a6d59f0e6402f697984b4d0b7a592c955c2421bdbc2cbe4fa9daf6", 0x84, 0x200}, {&(0x7f0000000540)="4a594cd1550abbefcb16237796a52080859089d7d8aabd1a22175215777dbeca995ac618500054679c5639340bcdaef8afeba265421c04f16b83cbd6fce2c60e44bc08c35f5acd8b54e1b5bbead3eef03ff0fc3b5ba980ff9fe1873cf5e31120a91b3f80f578f9dc1d0e33ec2cfa02821bda68c8f2977daf284e2ed4f9e09f6f201fbcea76136c36fb538ec0c84c0ad1b4db3e2b72915bbdecb6f0b216c18c41838b3b13abc417240a7fb8fb0268b9154bf6fca4d5f57dec777a85d530ac290470df600c7ce22d2c90cc9bb4e916decc790df7b8248a24a471e95f870b6ee187118a5ed3c45eb36576323fba32b8458e693308e8", 0xf4, 0x1}, {&(0x7f0000000640)="9f407419b15e4fee491eb16eccd4b97463ed64fd4abafa12ba433dbb3842ed19d12dd8106933a6d29b10c1ea71d7abc823be2d50d89eb2ec83ca22b7534aa2b3c60235c619898cc38ceb3625db9ee227ab4b45f5cefae1042da92ead38b8a06f0ed8a95d696c84fd6e0f3701ce9164eea1f2e53fc15c76e74420482d8c4b8e593e419a898e11e1b7c2e8217e25a6a6a239d5f70ddcc516d338b463fae455594bc45a182200fc6fbb81333f07de6a4fff75009e7bce0188f1665e8b6d326d42d49eeae42c34a1aa75f68521f0a4ae67ae05c0070a83b4f57b6c5f17abcf332f24ac0904fff3", 0xe5, 0x400}, {&(0x7f0000000340)="a73c75f2616a52660659afd04e848c52f4d7df24f6c1fa9f97432f49e10c8affd77e8933225c9e9a403a78193668fc566002f43623620afbfc67088cde6eb0e67c5f70e384f1a01683e8e1779276f203a3e06ef85d3cb4db954985cf172e", 0x5e, 0x100}, {&(0x7f0000000740)="4547db6d66e10e7346e6b009cba63a3f2747b35938651e794fdb1806b4f929e2faf55bd518cc5223e5e47a661eb1b0d81b228f384474b0c9e384c2640cef933879b447fadeed13e9a9727d9f1b9c065298cdda329382ef4fc50b143598480962f0f9ab162bb33fa7c0f18cf45811be25ea4109e6df57688b41a12e0199ed67470e0972", 0x83, 0x7}, {&(0x7f0000000800)="3ba7e65f772aa271dff280cc4da623c2efecf914d6b3cf33611404d2f862d04f5a52377fa3eddea11a0473e7728e0c0befda48de0c0cf19b3c1924c7ce840585acaf355d26cc7efb4cb65b4662f9c9f215eb0a14f0db17f3b58b93b083e09a45036adec50c032b7457ad3f2bf7ed24435d12273eeca5e8e37e9e9cec6f73bd9215778404d551d23391fa1ed5aee22dba499d6dc9f1f4393902f697f39e616669ad46dfc4625d89cc906b97023d29ceae0738946e8a4f8a07a6595bfbc8fb6b974ac599d2081cc43d41323103c8b1cbd11dc8e5106a01349dfb846040", 0xdc, 0x1}, {&(0x7f0000000900)="f5b175e6ee67ba4e2c81d10baf937fda98d21a9bd1852a2f0ce4b3199adf709c227b7929c6cc5b880c2877bf9616119ff33c3c4175aa94557ab0a3006f874a051b15d2228ab494540bb162b2cfc45af0b24da576cf077890e01adfd0e0aadabf7412adb66792c23b156c7cecb48b6cb63fe0dbc1f967accd06169628ed9e1fef0a08e511b9662bc609cae287d6bbf6cc4917720a842328fbc3b84ae1fb228209e8398b3d2c13c880a9776e4b3c1c499ae1a270910cacaa3087d204432fae7fc1d0d3ecf1a0428ed406a484ddc6d991cad06579e071ad07fe0ef541cdae1d", 0xde, 0x2}], 0x800, &(0x7f0000000b00)=ANY=[@ANYBLOB="71ee3d2a0aca9fe0d5c838dbffec5f2f5af52e71c1aa489bf5d2e93c3532aea546d4091ba73d1644ca76ae15a51f920e7d06cccea1df4794b271543fc31d6cafd837e680b5e7d0f86c5b80ffe243c726bc21b729ce20c50c2e5f59285b71cc2d6a824ca1ebe7"]) mkdir(&(0x7f0000000300)='./file0\x00', 0x80) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) lstat(&(0x7f00000003c0)='./file0/bus\x00', &(0x7f0000000400)) [ 911.479364] binder: 2476:2479 transaction failed 29201/-71, size 0-0 line 2816 [ 911.544357] binder: BINDER_SET_CONTEXT_MGR already set [ 911.558627] binder: 2476:2486 transaction failed 29189/-3, size 0-0 line 3035 04:48:56 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) timer_create(0x7, &(0x7f0000000000)={0x0, 0x2b, 0x7, @tid=0xffffffffffffffff}, &(0x7f0000000080)=0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timer_settime(r2, 0x0, &(0x7f0000000100)={{r3, r4+30000000}, {0x77359400}}, &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x5423) [ 911.605717] binder: 2476:2493 got reply transaction with no transaction stack [ 911.607451] binder: undelivered TRANSACTION_ERROR: 29201 [ 911.619670] binder: 2476:2479 ioctl 40046207 0 returned -16 04:48:56 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6e5) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300002, 0x0, 0x0, @ipv4={[], [], @multicast2}, @mcast2={0x3e}, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) readv(r2, &(0x7f00000017c0)=[{&(0x7f0000000440)=""/118, 0x76}], 0x1) poll(&(0x7f0000000380)=[{r2}], 0x1, 0x4) [ 911.670380] binder: 2476:2493 transaction failed 29201/-71, size 0-0 line 2801 [ 911.681105] binder: undelivered TRANSACTION_ERROR: 29189 [ 911.694802] binder: undelivered TRANSACTION_ERROR: 29201 04:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 911.801062] binder: 2507:2508 transaction failed 29201/-71, size 0-0 line 2816 [ 911.843552] binder: BINDER_SET_CONTEXT_MGR already set [ 911.849394] binder: 2507:2508 ioctl 40046207 0 returned -16 [ 911.857400] binder: undelivered TRANSACTION_ERROR: 29201 04:48:56 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:56 executing program 5: accept(0xffffffffffffffff, &(0x7f0000000440)=@ethernet={0x0, @broadcast}, &(0x7f0000000300)=0x32) r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x40046109, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x40046109, &(0x7f0000000300)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'ifb0\x00', 0x600}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000500)) syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'team0\x00'}) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x20400, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x10010, r0, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x7fffffff, 0x5, 0x9, &(0x7f0000ffc000/0x4000)=nil, 0x3ff}) recvmmsg(0xffffffffffffffff, &(0x7f0000009340)=[{{0xffffffffffffffff, 0x0, &(0x7f0000003280)=[{0x0}, {&(0x7f0000002200)=""/66, 0x42}, {&(0x7f0000002280)=""/4096, 0x1000}, {0x0}], 0x4, &(0x7f00000032c0)=""/224, 0xe0, 0x9}, 0xfffffffffffffffe}, {{&(0x7f00000034c0)=@sco, 0x80, &(0x7f0000003700)=[{0x0}, {&(0x7f0000003600)=""/253, 0xfd}], 0x2}, 0x5}, {{&(0x7f0000003980)=@ipx, 0x80, 0x0, 0x0, &(0x7f0000005c40)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000006c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000006dc0)=""/66, 0x42}, {&(0x7f0000006e40)=""/103, 0x67}], 0x2, 0x0, 0x0, 0x1000}, 0x5}, {{0x0, 0x0, &(0x7f0000007000), 0x0, &(0x7f0000007040)=""/66, 0x42, 0x800}, 0x7}, {{&(0x7f00000070c0)=@sco, 0x80, &(0x7f0000008300)=[{&(0x7f0000007140)=""/136, 0x88}, {&(0x7f0000007200)=""/213, 0xd5}], 0x2, &(0x7f0000008340)=""/4096, 0x1000, 0x49e1}, 0x1}], 0x6, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept$alg(r2, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x1, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1, 0x0, &(0x7f0000001380)={0x77359400}) 04:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:56 executing program 2: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000580)='/dev/cachefiles\x00', 0x1, 0x0) ioctl$KVM_SMI(r0, 0xaeb7) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x3, 0x4080) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x80, @local, 0x6}}, [0x80000001, 0xb0f, 0x80000001, 0x1ff, 0x3f, 0x80000001, 0x2, 0x3f, 0x7fffffff, 0x43, 0x0, 0x8, 0x80, 0xff, 0x3]}, &(0x7f0000000380)=0x100) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f00000003c0)={r3, 0x9, 0x20, 0x7, 0x80}, &(0x7f0000000400)=0x18) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f00000001c0)={@remote, @local, @initdev}, &(0x7f0000000200)=0xc) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f00000005c0)=0x5, 0x4) ioctl$PPPIOCGUNIT(r2, 0x80047456, &(0x7f0000000500)) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000340)={0x9, 0x1401f, 0x0, 0xffffffffffffff9c}) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000540)={0x6, 0x6, 0x4, 0x9, 0x5, 0x0, 0x10001, 0x4, 0xfff, 0x5, 0xa977, 0xd8}) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000040)) socket$xdp(0x2c, 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000004c0)={0x9e0000, 0x5, 0x8, [], &(0x7f0000000480)={0xbf09e7, 0x0, [], @p_u8=&(0x7f0000000440)=0x4000000000000}}) pwrite64(r4, &(0x7f00000000c0)="874ec26879abf6f800dd60a7fc30f1aafe235ce256ec9c485de24a26d59fb357baf4c831a976cf46686c41b563429e8731803aad95618bc3b62945b947dd2a703339d25695d5cfbbf8ef0ea943022a7ced1c4edebbb5801e9b5ff91db157fc336e410f3d1c5b4b97d2da4d7c846313c628088c551bfbaffd89299760116eda2017d3b80234c5a0824210d9eb3e2bff73c0176ba19f2e26fe82d37c16d47d7be944c3851084e6da", 0xa7, 0x0) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000000)) modify_ldt$write2(0x11, &(0x7f0000000600)={0x8f, 0xffffffffffffffff, 0xffffffffffffffff, 0x1000, 0x8000, 0x7, 0x200, 0x7, 0x7fc000000}, 0x10) [ 912.046088] device nr0 entered promiscuous mode 04:48:56 executing program 4: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000240)={0x0, 0x0}) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x8, 0x200000) r3 = geteuid() getresuid(&(0x7f0000000800), &(0x7f0000000840)=0x0, &(0x7f0000000880)) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0x8000, 0x8, &(0x7f0000000740)=[{&(0x7f0000000140)="65523f9e4e610567b1f0322d62ba3bfb4daf278cdbc3b4b79c2877045c3bdb5a37abee050a95336d6e6d903119733f18c6a95871b0806873068a489467977881f3d291d54914e18f043f1ecf", 0x4c, 0x7cd15385}, {&(0x7f0000000280)="e00e53f160e4480ad7160dc4393f91e14317ba99fa2e13a0197d851a75bd058ff9a99c1056fae250dd09393ad42da1cdc9b979b24693fc9f55fbb4e577075acbfffa8a3d5349c66d0b7b85c761831a6ad2dcba4670386bf6d3d0f6a06688ac53e56df7869b21da4fd0a28187d38bf76bf963f1603e6eb4d526d0be97243343a2b92d1909d00049a375fde6a9f865251477c7352944f8173353f613378242178dab", 0xa1, 0x6}, {&(0x7f0000000340)="96a303b5c9094c446514978fe5e700fe3cff816a9fc5eebc765bcc820cf7b5cfaa65f635af4b0b5e167f73bc0dc0173c87dbc925f11fae373cb1a3dbd783c332f72b3283b30bf5aeca8ead222ece76aa4604dd7cb9417658e0198931770ea81faaf37efdd742a220c5a0f7d6cc244308fda0daf3b8d7939ffcd95f12f3abaeff1e6163044851e1dbb738a7d9750b5cda7e1297b67b7ed8b5d376880076f0af71a34f1abce5ef3c0f8460750251a11f9bb46ed626d3139f234805f84f1007415861202268724caaf3691fcff5c1d18637de47e00857c327c28fb088b7eced5b833d", 0xe1, 0x3}, {&(0x7f0000000440)="88b61ec882cd76a45f0ae069da401408108a2ba37a211f0c236e7fbefb0e21e6cb622ad458839387501f751d12f03708d638c7fc2e8331a5be1eb9d82917f819c50aef24d3604f37444db4c2b09d592c4b0e7a4e0f510cfdc293103cd2953861a6a92405c603e0c05f8e9bd95580f79d26cb10b1592bc4c21098447ccb1a47de0ad04cb6943149a36d591a0ad89bf65abded18fb3307009d3fa98ee0fe4e0a010e6a6a912b67eac6c6c7b9d4b5c8b955e241813b400d84decd51a46cff906068b9139558428f3ef9abaadae21769911c1ed751d6e699acf6b2c232106565f5e2", 0xe0, 0x9}, {&(0x7f0000000540)="5ad6e63b982578dba39d052f25f0a42264401782b536f891f17c0963cf4be98cb07ff16730487c3a4bda13f37212483b821fe5d141ecf4abe7e5cad09bdce617f2dc1a0ee647a8620653c3e8c6f533d3632ad1a649a90a5b316bc899056be35957767db6de0b6cb9b146de14c0241d04c5342bf7ad28d6b1d0f48138bf4726845ff4d6cb937fea22e4bc155c293c2de57663624364e3a1c45cb1bd5af6985a2900c19103e341bad6", 0xa8, 0x6}, {&(0x7f00000001c0)="01f409648fca55e3f90cd930aa25bb4a44877808ce8000ac8646b3b1454214ef9ae2f2f84b6ddfab7684e38f63b009b6b8cae3abce5dae76e8418242450d66eaafe8ec29a7b224b989", 0x49, 0x9}, {&(0x7f0000000600)="a1a9978db5ebe7f905f1bc9a15929e2c23c7bb39eb83e9065493dc44dfa5304c7ea077d7cefe330ead", 0x29, 0x2}, {&(0x7f0000000640)="5a2f0099ae4c20858bbeab5015441431e4eff1f60ba5548c18f4ecdd19e1a31d3f7813ff828132f29ccb2522b8a9987c6ab1ab0adafd0cd1cdeae1f48085f3c66797d92fbed74d574c426865a7968e9bc263cf1594d2ed3ddfc15a1f25b3e06632a8ce7394c7a2a0d0ed46e7eab5adcfb53595d98056551aa99b9579b9897ac9ffe71f7b692cfa3ad39cc728fa26b9fd814542be274067ae0f451b537fb977c748071b8945a115390d2cefd7b70c45f4aff9708dd2a0edd6499d4ff441bddbce79c86327279978f554f211cff9d93fb08d1d420733804d1a144644d510e225fbc7e153266eb43af1fa135c272c40f988f3e98f750ea14ba35c36d4", 0xfb, 0x2}], 0x10000, &(0x7f00000008c0)={[{@dots='dots'}, {@dots='dots'}], [{@smackfshat={'smackfshat', 0x3d, 'posix_acl_access\\@cpusetcgroupbdev'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/input/mouse#\x00'}}, {@measure='measure'}, {@fowner_eq={'fowner', 0x3d, r3}}, {@uid_eq={'uid', 0x3d, r4}}]}) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0xffff) timer_create(0x0, &(0x7f0000000000)={0x0, 0x0, 0x4, @tid=r1}, &(0x7f0000000040)) [ 912.101050] binder: BINDER_SET_CONTEXT_MGR already set [ 912.138581] binder: 2512:2515 ioctl 40046207 0 returned -16 [ 912.139269] binder: send failed reply for transaction 1918 to 2512:2515 04:48:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 912.313056] binder: BINDER_SET_CONTEXT_MGR already set [ 912.332341] binder: 2538:2541 ioctl 40046207 0 returned -16 04:48:57 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:57 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x3) r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000003c0)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000216e7502cbb498116a7a9702f2d66f115585665d68949d2d60df79ae4fb6ca24129ded7daedde59b7c096df285782fc6e7eed0cc104ba334549b1abcce35924dede285b83b958ce7ce26161f41867abf45fc"], 0x78) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0xda9, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000ec0)="61ce6ed94f41f48fddb17be75acd3fd8976f2f631226482bfc0c6321cc4cae47952fade164de0d115b601581953f9a337ea011906254b229aa6c3a8d246142c633fc0f54b0218c5becb9fd513c8914bdfad4668e36b8ffb24d6f7dc5e8119510898eca216a75ce4e6a295af4b6bc4dae50e31997f687b4bbc532210cef625534447e1a449d37a6163113a57c34f68e15230f660c161a41fa5330b0f852d2e337c373b2efe237dad926b57ba2421c33d21b5f8b412a3468010211cc46be2fc19f9731cab96ede51d8989cde2cb4441738cdaf083a8920183b35d83f76b8b1f8e87d4f722e621253ecc5586ba77656405fbc063570771c846066f1941797db0e7495a6e272d08d5f80008e03c011b2644f46d24e7e5f03c1ebab168f358fa9609c350cd90a958a12d8dc87096fb5c850a9f7e2c196bf9dd70614cb74b3f2f39d33797c12ccba2c9f86d70594c2ab5d30ef241e90b48226cb163c891ef8dc35665f237f00e8cfd2f36abe46439e29121c519bdf5c30c8d8c16470e017464f064b21f16a79873e6b6716fc65413297a99cf411009cd534f0e39e473074b98e1a25da73433f612fc3678f47eb8cc124888778bfe7e09297f08413dbee581b0fb5da777b21b9f64e44b1feb1e19e90bea690b68ff77becc2c48a5d1e0f0b89cf1eff167524d2c84df7893d4aadfac6d14240d3105e50efe3b5cb3c787044e311d064399f643ec538279774494e6e1bc1222fdd752695bb3ac97e054d4edea5da9bfa548bf1f89a748b6629eb4ceb19beb15c9ba2eae08064f26421c2f3200d2eed488c3ddb7c82b9eb5ab2f99eb4a3bb6e9c3604b2883de57968f01b30a6d01243c592bd92f7e0f576b6a8c8b77078c61b0dfece52e3120f17fef07621680fead85ab28048c1c10ed6e91dc48561ad86e93ac9c203fbdbdcf095128336f26593da6fd0f121554cf7c04ccf584481b042a2d81faedad175192f76b5ffc4b074d3ba9810068a084a08653eef3d35e30ed75c632b5a95b8b07e03ff7731d2ed8ef214dbd434a93b182469dabb71c38c3f805d332326db31e8e38ff2dd6efba54c99b4790347c34d3227bd8ef2f2f413870044a27f982ba668faa1299a8616952d4a83c1c60f40e003998ca216a12c7a92e9f1d3c804942c81bb8dc69c022bc3a3cab799daeb15194393b8de2a792e9b96646e4d0493724bf39f3d4bc1a38eb54c7ecae231dce72558ca44f9687f1ef0b88277930c640b1057e3b76262be58ed002226b8430ba85c799d21f0da7780911dd83b81519542de805fe6dcfde8383953a0231db346d4cfb6087b766c1818f99dc3c4c993ee82d5d773c2d78859763d5ee5a901fb9fafc3a1480d9934fb4263da87ef0b33f063bad023cac9afcf547c3215227d5596d41df61be61afbdc720484378e09edd5d07f6f08070821ebe57c1a5aa538a766653d61ac4b1e3ac8fabdcad5202c39ea2756e523acd169e04a0f223ddbbc1ea05222f4adaca0da7b25a654d4da3950be8a2da3c824e9c026adb54ab1e90849ecd75d7a7944ca1149fcf294e60a8baa393b05fcf85ff5579bbe11ac66c8a7ed68d238841a37b2940f12a9776eada8585872a25f22484a47b75dc3ca537ccc1efe5ca584e24ae14daeaa72abb17fc25b2eeb29c16b0143b3ce978dbf0b21c8bf2c11c4986cba99d69c9ddbf5c23d592265", 0x4b1}], 0x1) writev(r0, &(0x7f00000005c0)=[{&(0x7f0000001380)="9518a53edb0f924b1b6d6a046cd2b3fccffe64617fce7693f76106b1424bd4654e99d3cc08eee21b9b3a3d5f115d4cf5ac51d3d662ff9ff11c17aa5325927adcbf3b626e602529c80fef87dcc1311cec08446ca4b5ffe9ec2d992a8387b4c421f4af9830f65148d788a8a7144725ae37823716a04121e6fce64fc08cf6fbba1004d54639e6ddb70d19f2816c94818b586872e7dbe71bf9ad81b1b4048745c9742a48adbd137b67937502a80da8bedfda89e92fb3ba218b9132a41296001ed0dc67e3f9807f2b07453b15e28377b7d6ea059a6afc167ab98b21dd476f09e893fe5f112c45b922e88752f8f34e16d198770dd2e0b4c60c69adec0b1aae3fdbb7d6476e4ebee1484228e805d12b71c1d5317bc25d696e42a01672c5e5355118c1b9df2f3de86898a19ce6f90375539d61895e54b286b7823a424fd7880964b4440e30a42f70457375e65ecbbac306b40501e99a88e983e8e6c047e9fcef996485bdd8892ff090ab9c91d152c8ef945db6901c6b00b5ca7f5ce256a65f6b8b180ee9f7d745ca6792fe869fe9fc318d4f71a6de05bed216bf7805d5d30912522d002ea9034946f43ed2b74749e120d308b042025957e4a982eb1335041e7bfb87c144c6b4", 0x1c2}], 0x1) setsockopt$packet_buf(r2, 0x107, 0x6, &(0x7f0000000240)="375e1cdc04ede8d1dcbcbd8174a331ab9f3e8651142a1da2c86124e36b1a1ffdb6006d25069dada1c0cdcd0118aa550f94fd68a46c696d650bcd6c19969da7570bccbc4f926b074fe889a5589e4c0995d796197c546aa5bd67144e2e98bf6c8488c34dd77a885cf0cd5c45cc2ff01a3249af721636d7", 0x76) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r2, 0x10, &(0x7f00000001c0)={&(0x7f0000000140)=""/32, 0x20, 0xffffffffffffffff}}, 0x10) 04:48:57 executing program 5: accept(0xffffffffffffffff, &(0x7f0000000440)=@ethernet={0x0, @broadcast}, &(0x7f0000000300)=0x32) r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x40046109, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x40046109, &(0x7f0000000300)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'ifb0\x00', 0x600}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000500)) syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'team0\x00'}) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x20400, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x10010, r0, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, 0x7fffffff, 0x5, 0x9, &(0x7f0000ffc000/0x4000)=nil, 0x3ff}) recvmmsg(0xffffffffffffffff, &(0x7f0000009340)=[{{0xffffffffffffffff, 0x0, &(0x7f0000003280)=[{0x0}, {&(0x7f0000002200)=""/66, 0x42}, {&(0x7f0000002280)=""/4096, 0x1000}, {0x0}], 0x4, &(0x7f00000032c0)=""/224, 0xe0, 0x9}, 0xfffffffffffffffe}, {{&(0x7f00000034c0)=@sco, 0x80, &(0x7f0000003700)=[{0x0}, {&(0x7f0000003600)=""/253, 0xfd}], 0x2}, 0x5}, {{&(0x7f0000003980)=@ipx, 0x80, 0x0, 0x0, &(0x7f0000005c40)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000006c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000006ec0)=[{&(0x7f0000006dc0)=""/66, 0x42}, {&(0x7f0000006e40)=""/103, 0x67}], 0x2, 0x0, 0x0, 0x1000}, 0x5}, {{0x0, 0x0, &(0x7f0000007000), 0x0, &(0x7f0000007040)=""/66, 0x42, 0x800}, 0x7}, {{&(0x7f00000070c0)=@sco, 0x80, &(0x7f0000008300)=[{&(0x7f0000007140)=""/136, 0x88}, {&(0x7f0000007200)=""/213, 0xd5}], 0x2, &(0x7f0000008340)=""/4096, 0x1000, 0x49e1}, 0x1}], 0x6, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept$alg(r2, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x1, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1, 0x0, &(0x7f0000001380)={0x77359400}) 04:48:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)) unshare(0x40400) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crc32\x00'}, 0x58) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mq_open(0x0, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg(r2, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x200056d0, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) accept4$x25(r5, 0x0, 0x0, 0x800) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/mcfilter6\x00') r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r6, &(0x7f0000000380)={&(0x7f0000000200), 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x74, r7, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x60, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe358}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000801}, 0x4000) 04:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 912.525055] device nr0 entered promiscuous mode [ 912.612984] binder_transaction: 6 callbacks suppressed [ 912.612998] binder: 2550:2553 got reply transaction with bad transaction stack, transaction 1926 has target 2550:0 04:48:57 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x3) r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000003c0)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000216e7502cbb498116a7a9702f2d66f115585665d68949d2d60df79ae4fb6ca24129ded7daedde59b7c096df285782fc6e7eed0cc104ba334549b1abcce35924dede285b83b958ce7ce26161f41867abf45fc"], 0x78) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0xda9, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000ec0)="61ce6ed94f41f48fddb17be75acd3fd8976f2f631226482bfc0c6321cc4cae47952fade164de0d115b601581953f9a337ea011906254b229aa6c3a8d246142c633fc0f54b0218c5becb9fd513c8914bdfad4668e36b8ffb24d6f7dc5e8119510898eca216a75ce4e6a295af4b6bc4dae50e31997f687b4bbc532210cef625534447e1a449d37a6163113a57c34f68e15230f660c161a41fa5330b0f852d2e337c373b2efe237dad926b57ba2421c33d21b5f8b412a3468010211cc46be2fc19f9731cab96ede51d8989cde2cb4441738cdaf083a8920183b35d83f76b8b1f8e87d4f722e621253ecc5586ba77656405fbc063570771c846066f1941797db0e7495a6e272d08d5f80008e03c011b2644f46d24e7e5f03c1ebab168f358fa9609c350cd90a958a12d8dc87096fb5c850a9f7e2c196bf9dd70614cb74b3f2f39d33797c12ccba2c9f86d70594c2ab5d30ef241e90b48226cb163c891ef8dc35665f237f00e8cfd2f36abe46439e29121c519bdf5c30c8d8c16470e017464f064b21f16a79873e6b6716fc65413297a99cf411009cd534f0e39e473074b98e1a25da73433f612fc3678f47eb8cc124888778bfe7e09297f08413dbee581b0fb5da777b21b9f64e44b1feb1e19e90bea690b68ff77becc2c48a5d1e0f0b89cf1eff167524d2c84df7893d4aadfac6d14240d3105e50efe3b5cb3c787044e311d064399f643ec538279774494e6e1bc1222fdd752695bb3ac97e054d4edea5da9bfa548bf1f89a748b6629eb4ceb19beb15c9ba2eae08064f26421c2f3200d2eed488c3ddb7c82b9eb5ab2f99eb4a3bb6e9c3604b2883de57968f01b30a6d01243c592bd92f7e0f576b6a8c8b77078c61b0dfece52e3120f17fef07621680fead85ab28048c1c10ed6e91dc48561ad86e93ac9c203fbdbdcf095128336f26593da6fd0f121554cf7c04ccf584481b042a2d81faedad175192f76b5ffc4b074d3ba9810068a084a08653eef3d35e30ed75c632b5a95b8b07e03ff7731d2ed8ef214dbd434a93b182469dabb71c38c3f805d332326db31e8e38ff2dd6efba54c99b4790347c34d3227bd8ef2f2f413870044a27f982ba668faa1299a8616952d4a83c1c60f40e003998ca216a12c7a92e9f1d3c804942c81bb8dc69c022bc3a3cab799daeb15194393b8de2a792e9b96646e4d0493724bf39f3d4bc1a38eb54c7ecae231dce72558ca44f9687f1ef0b88277930c640b1057e3b76262be58ed002226b8430ba85c799d21f0da7780911dd83b81519542de805fe6dcfde8383953a0231db346d4cfb6087b766c1818f99dc3c4c993ee82d5d773c2d78859763d5ee5a901fb9fafc3a1480d9934fb4263da87ef0b33f063bad023cac9afcf547c3215227d5596d41df61be61afbdc720484378e09edd5d07f6f08070821ebe57c1a5aa538a766653d61ac4b1e3ac8fabdcad5202c39ea2756e523acd169e04a0f223ddbbc1ea05222f4adaca0da7b25a654d4da3950be8a2da3c824e9c026adb54ab1e90849ecd75d7a7944ca1149fcf294e60a8baa393b05fcf85ff5579bbe11ac66c8a7ed68d238841a37b2940f12a9776eada8585872a25f22484a47b75dc3ca537ccc1efe5ca584e24ae14daeaa72abb17fc25b2eeb29c16b0143b3ce978dbf0b21c8bf2c11c4986cba99d69c9ddbf5c23d592265", 0x4b1}], 0x1) writev(r0, &(0x7f00000005c0)=[{&(0x7f0000001380)="9518a53edb0f924b1b6d6a046cd2b3fccffe64617fce7693f76106b1424bd4654e99d3cc08eee21b9b3a3d5f115d4cf5ac51d3d662ff9ff11c17aa5325927adcbf3b626e602529c80fef87dcc1311cec08446ca4b5ffe9ec2d992a8387b4c421f4af9830f65148d788a8a7144725ae37823716a04121e6fce64fc08cf6fbba1004d54639e6ddb70d19f2816c94818b586872e7dbe71bf9ad81b1b4048745c9742a48adbd137b67937502a80da8bedfda89e92fb3ba218b9132a41296001ed0dc67e3f9807f2b07453b15e28377b7d6ea059a6afc167ab98b21dd476f09e893fe5f112c45b922e88752f8f34e16d198770dd2e0b4c60c69adec0b1aae3fdbb7d6476e4ebee1484228e805d12b71c1d5317bc25d696e42a01672c5e5355118c1b9df2f3de86898a19ce6f90375539d61895e54b286b7823a424fd7880964b4440e30a42f70457375e65ecbbac306b40501e99a88e983e8e6c047e9fcef996485bdd8892ff090ab9c91d152c8ef945db6901c6b00b5ca7f5ce256a65f6b8b180ee9f7d745ca6792fe869fe9fc318d4f71a6de05bed216bf7805d5d30912522d002ea9034946f43ed2b74749e120d308b042025957e4a982eb1335041e7bfb87c144c6b4", 0x1c2}], 0x1) setsockopt$packet_buf(r2, 0x107, 0x6, &(0x7f0000000240)="375e1cdc04ede8d1dcbcbd8174a331ab9f3e8651142a1da2c86124e36b1a1ffdb6006d25069dada1c0cdcd0118aa550f94fd68a46c696d650bcd6c19969da7570bccbc4f926b074fe889a5589e4c0995d796197c546aa5bd67144e2e98bf6c8488c34dd77a885cf0cd5c45cc2ff01a3249af721636d7", 0x76) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r2, 0x10, &(0x7f00000001c0)={&(0x7f0000000140)=""/32, 0x20, 0xffffffffffffffff}}, 0x10) [ 912.743040] binder_alloc_mmap_handler: 6 callbacks suppressed [ 912.743057] binder_alloc: binder_alloc_mmap_handler: 2550 20001000-20004000 already mapped failed -16 [ 912.788571] binder: BINDER_SET_CONTEXT_MGR already set [ 912.807088] binder: 2550:2553 ioctl 40046207 0 returned -16 [ 913.103830] binder: send failed reply for transaction 1926 to 2550:2553 [ 913.107168] device nr0 entered promiscuous mode [ 913.115685] binder_release_work: 6 callbacks suppressed [ 913.115691] binder: undelivered TRANSACTION_COMPLETE 04:48:57 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:57 executing program 5: socketpair$unix(0x1, 0x8000000000002, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0x10, 0x3, 0x0) socketpair(0xf, 0x4, 0x4, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x4e22, @multicast1}}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x8001, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000180)={0xffffffffffff7fff, 0x5}) sendmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000100)="5500000018007f5300fe01b2a4a280930a600000ffa84306910000003900070035000c0006fffffffffffffffa000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab91d4", 0x55}], 0x1}, 0x0) 04:48:57 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x3) r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000003c0)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000216e7502cbb498116a7a9702f2d66f115585665d68949d2d60df79ae4fb6ca24129ded7daedde59b7c096df285782fc6e7eed0cc104ba334549b1abcce35924dede285b83b958ce7ce26161f41867abf45fc"], 0x78) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0xda9, 0x4) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000ec0)="61ce6ed94f41f48fddb17be75acd3fd8976f2f631226482bfc0c6321cc4cae47952fade164de0d115b601581953f9a337ea011906254b229aa6c3a8d246142c633fc0f54b0218c5becb9fd513c8914bdfad4668e36b8ffb24d6f7dc5e8119510898eca216a75ce4e6a295af4b6bc4dae50e31997f687b4bbc532210cef625534447e1a449d37a6163113a57c34f68e15230f660c161a41fa5330b0f852d2e337c373b2efe237dad926b57ba2421c33d21b5f8b412a3468010211cc46be2fc19f9731cab96ede51d8989cde2cb4441738cdaf083a8920183b35d83f76b8b1f8e87d4f722e621253ecc5586ba77656405fbc063570771c846066f1941797db0e7495a6e272d08d5f80008e03c011b2644f46d24e7e5f03c1ebab168f358fa9609c350cd90a958a12d8dc87096fb5c850a9f7e2c196bf9dd70614cb74b3f2f39d33797c12ccba2c9f86d70594c2ab5d30ef241e90b48226cb163c891ef8dc35665f237f00e8cfd2f36abe46439e29121c519bdf5c30c8d8c16470e017464f064b21f16a79873e6b6716fc65413297a99cf411009cd534f0e39e473074b98e1a25da73433f612fc3678f47eb8cc124888778bfe7e09297f08413dbee581b0fb5da777b21b9f64e44b1feb1e19e90bea690b68ff77becc2c48a5d1e0f0b89cf1eff167524d2c84df7893d4aadfac6d14240d3105e50efe3b5cb3c787044e311d064399f643ec538279774494e6e1bc1222fdd752695bb3ac97e054d4edea5da9bfa548bf1f89a748b6629eb4ceb19beb15c9ba2eae08064f26421c2f3200d2eed488c3ddb7c82b9eb5ab2f99eb4a3bb6e9c3604b2883de57968f01b30a6d01243c592bd92f7e0f576b6a8c8b77078c61b0dfece52e3120f17fef07621680fead85ab28048c1c10ed6e91dc48561ad86e93ac9c203fbdbdcf095128336f26593da6fd0f121554cf7c04ccf584481b042a2d81faedad175192f76b5ffc4b074d3ba9810068a084a08653eef3d35e30ed75c632b5a95b8b07e03ff7731d2ed8ef214dbd434a93b182469dabb71c38c3f805d332326db31e8e38ff2dd6efba54c99b4790347c34d3227bd8ef2f2f413870044a27f982ba668faa1299a8616952d4a83c1c60f40e003998ca216a12c7a92e9f1d3c804942c81bb8dc69c022bc3a3cab799daeb15194393b8de2a792e9b96646e4d0493724bf39f3d4bc1a38eb54c7ecae231dce72558ca44f9687f1ef0b88277930c640b1057e3b76262be58ed002226b8430ba85c799d21f0da7780911dd83b81519542de805fe6dcfde8383953a0231db346d4cfb6087b766c1818f99dc3c4c993ee82d5d773c2d78859763d5ee5a901fb9fafc3a1480d9934fb4263da87ef0b33f063bad023cac9afcf547c3215227d5596d41df61be61afbdc720484378e09edd5d07f6f08070821ebe57c1a5aa538a766653d61ac4b1e3ac8fabdcad5202c39ea2756e523acd169e04a0f223ddbbc1ea05222f4adaca0da7b25a654d4da3950be8a2da3c824e9c026adb54ab1e90849ecd75d7a7944ca1149fcf294e60a8baa393b05fcf85ff5579bbe11ac66c8a7ed68d238841a37b2940f12a9776eada8585872a25f22484a47b75dc3ca537ccc1efe5ca584e24ae14daeaa72abb17fc25b2eeb29c16b0143b3ce978dbf0b21c8bf2c11c4986cba99d69c9ddbf5c23d592265", 0x4b1}], 0x1) writev(r0, &(0x7f00000005c0)=[{&(0x7f0000001380)="9518a53edb0f924b1b6d6a046cd2b3fccffe64617fce7693f76106b1424bd4654e99d3cc08eee21b9b3a3d5f115d4cf5ac51d3d662ff9ff11c17aa5325927adcbf3b626e602529c80fef87dcc1311cec08446ca4b5ffe9ec2d992a8387b4c421f4af9830f65148d788a8a7144725ae37823716a04121e6fce64fc08cf6fbba1004d54639e6ddb70d19f2816c94818b586872e7dbe71bf9ad81b1b4048745c9742a48adbd137b67937502a80da8bedfda89e92fb3ba218b9132a41296001ed0dc67e3f9807f2b07453b15e28377b7d6ea059a6afc167ab98b21dd476f09e893fe5f112c45b922e88752f8f34e16d198770dd2e0b4c60c69adec0b1aae3fdbb7d6476e4ebee1484228e805d12b71c1d5317bc25d696e42a01672c5e5355118c1b9df2f3de86898a19ce6f90375539d61895e54b286b7823a424fd7880964b4440e30a42f70457375e65ecbbac306b40501e99a88e983e8e6c047e9fcef996485bdd8892ff090ab9c91d152c8ef945db6901c6b00b5ca7f5ce256a65f6b8b180ee9f7d745ca6792fe869fe9fc318d4f71a6de05bed216bf7805d5d30912522d002ea9034946f43ed2b74749e120d308b042025957e4a982eb1335041e7bfb87c144c6b4", 0x1c2}], 0x1) setsockopt$packet_buf(r2, 0x107, 0x6, &(0x7f0000000240)="375e1cdc04ede8d1dcbcbd8174a331ab9f3e8651142a1da2c86124e36b1a1ffdb6006d25069dada1c0cdcd0118aa550f94fd68a46c696d650bcd6c19969da7570bccbc4f926b074fe889a5589e4c0995d796197c546aa5bd67144e2e98bf6c8488c34dd77a885cf0cd5c45cc2ff01a3249af721636d7", 0x76) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r2, 0x10, &(0x7f00000001c0)={&(0x7f0000000140)=""/32, 0x20, 0xffffffffffffffff}}, 0x10) 04:48:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x2}) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000000)={0x7b, 0x0, [0x4b564d02, 0x3]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 913.211330] binder: 2579:2581 got reply transaction with bad transaction stack, transaction 1929 has target 2579:0 [ 913.261468] binder_alloc: binder_alloc_mmap_handler: 2579 20001000-20004000 already mapped failed -16 [ 913.318226] binder: BINDER_SET_CONTEXT_MGR already set [ 913.329475] binder: 2579:2581 ioctl 40046207 0 returned -16 [ 913.337265] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 913.337273] binder_alloc: 2579: binder_alloc_buf, no vma 04:48:57 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000602000/0x3000)=nil, 0x3000, &(0x7f0000000280)=""/63) r0 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@ethernet={0x0, @link_local}, &(0x7f0000000080)=0x80, 0x80000) bind$nfc_llcp(r0, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x1, 0x5, 0x1f, "ad6547f2872e17a032914927596e65424c334123ca968ca0a948c9d7614a6516a55cfea88b8c94371309a3f50a982b76e9e2300921a6241014e5f6cba3cd7f", 0x38}, 0x60) uselib(&(0x7f0000000140)='./file0\x00') [ 913.369465] binder: 2579:2581 got reply transaction with no transaction stack [ 913.377156] binder_thread_release: 3 callbacks suppressed [ 913.377167] binder: release 2579:2581 transaction 1929 out, still active [ 913.397003] binder: undelivered TRANSACTION_COMPLETE [ 913.419030] binder_send_failed_reply: 3 callbacks suppressed [ 913.419037] binder: send failed reply for transaction 1929, target dead [ 913.630664] IPv6: NLM_F_REPLACE set, but no existing node found! [ 913.708224] device nr0 entered promiscuous mode 04:48:58 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:58 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = accept$netrom(0xffffffffffffffff, &(0x7f0000000000)={{0x3, @null}, [@rose, @default, @bcast, @netrom, @default, @rose, @rose, @rose]}, &(0x7f0000000180)=0x48) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000001c0)={'vcan0\x00', 0x1000}) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000080)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x200200, 0x0) ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000240)) r3 = socket$inet6(0xa, 0x3, 0x2000000000003a) setsockopt$inet_sctp6_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000040)=0x8, 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, [], 0x1d}, 0xb013}}, 0x7fff, 0x1, 0x2, 0x6, 0xe5}, &(0x7f00000004c0)=0x98) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000500)={r4, 0x9, 0x20, 0x3, 0x10001, 0x3e000000}, 0x14) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000003c0)={0x0, @multicast1}, &(0x7f0000000380)=0xc) connect(r2, &(0x7f0000000280)=@xdp={0x2c, 0x7, r5, 0x35}, 0x80) setsockopt$inet6_int(r3, 0x29, 0xc8, &(0x7f00000007c0), 0x4) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000300)={0x4, 0x80000001, 0x1000000}) acct(&(0x7f0000000340)='./file0\x00') ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f0000000540)={{0x7, 0x20, 0x6e01, 0x2, 0x5, 0xfffffffffffffe00}, 0x7, 0x9, 0x1}) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc, 0xe, 0x8}, 0xc) 04:48:58 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x50, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000540)={0xffffffffffffffff}, 0x106, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffff9c, &(0x7f0000000400)={0x6, 0x118, 0xfa00, {{0x1f, 0x10000, "655b2664b12c01aec4f060ffecdd0947d0ec4ec974143365a317eceeb6c39405a327eb7ab6c48ae2a5a485e755a8123938748c4340f7a8719375719ec92fc3bca76eec27847caeae34df8ddc72b47cd0c4955f773506f5ea575033e335205af1e7986ae7c9a3964974c33628e86302daba94864c33d027401ded60bde4931c49de642397531a4d17f7b712a3a95ceb1d240b8476d1fed1ae2d21194d74c764ba88970b7a27ab498781bbcf8952fcfe43312e89dc4c9f687dab135a6a32dec450f57d32859c733e11ac97eed0bba6ec589b6545a2228d1226013efefb0baaf230cdbd778f72ccb124f262baf43c052a002d700e4caf56dc513fd8e76b332186d2", 0x9d, 0x10001, 0x7, 0x3, 0x40, 0x8, 0x73d, 0x1}, r0}}, 0x120) r1 = creat(&(0x7f00000001c0)='./file0/bus\x00', 0x0) fcntl$lock(r1, 0x7, &(0x7f0000027000)={0x1}) recvmmsg(0xffffffffffffffff, &(0x7f0000000180)=[{{0x0, 0x3dc, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r2, &(0x7f0000000480), 0x100000000000021c, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f00000002c0), &(0x7f0000000580)=0x1da) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b4000000", @ANYRES16=r3, @ANYBLOB="010f28bd7000ffdbdfb9892515000000340002ad4136ac00010001000800020000020000080001000104000008000200070000000800010000000000080002006e1a0000140001001000ec73797a31000000004c000900080001000300000008000100010000080001000900000008000200100e0000080001006ac4000008000100020000000800020040000000080002000000000008000100070000000c00000000000000000000000000000000007cab629cf47e8c4b38e04c4b4aaee187a819ad2f120eedbaa9315e91b537316f7fa1689dff0bdf9c7e83398d492266c18efd16d280d242cc2e6030a92192bae2023ac0cb3d1b8d289aa63cd8c3531d0508f35d978292379d12d4d0e7c58d905078eea1d93a2cc985b6df74bf86b74f42c714f8e6bfbf79cd93b180c25f0d123f0c7a5df330aa31961e2896dac4406ca6693d61d5ba4a763e029894490a97ac672474a3bf317570b70614afe4c088c8169dd4c3fb25fb"], 0xb4}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000010) 04:48:58 executing program 5: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000a40)=ANY=[]}, 0x1, 0x0, 0x0, 0x20004081}, 0x80000000000050) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000300)=@in6={0xa, 0x0, 0x7f, @loopback}, 0x300) [ 913.814229] binder: 2610:2613 got reply transaction with bad transaction stack, transaction 1934 has target 2610:0 04:48:58 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) symlinkat(&(0x7f00000004c0)='./file0\x00', r2, &(0x7f0000000480)='./file0\x00') set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="bd2b2b2a0000000400000000000000000000000100000000000000be000000000000000200000000000000000049a6de7c5ed3b714ee8caa9284c8fd3bdfd1d9ba4c63759a07ab4ca52bb2aac124cb33290dab0b49f7f225a9df"], 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5601039df973b53d859e769464fe24500000000"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f0000000740)=ANY=[@ANYBLOB="da4011289be44845084d057497ad96046d7e39df317d25b056f2717be2aa41208092d1313190ef285cdc968ec49ed179b048f1a86b9424e92f5d5d0a92cbcfb065a6552df9b664cd64645469fdec9423f36882427ddbb66dfb38540365d49315eaa6be128e809da75cf013"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) write$FUSE_OPEN(0xffffffffffffffff, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f0000000540)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x13) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000900)={[0x80000000, 0x1, 0x47, 0xffffffffffffffc1, 0x2, 0x80000000, 0x7f, 0xc6f5, 0x9, 0x3ff000, 0x5, 0x8000, 0x5, 0x0, 0x5, 0x8], 0x3000, 0x900}) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 913.876165] binder_alloc: binder_alloc_mmap_handler: 2610 20001000-20004000 already mapped failed -16 [ 913.891852] binder: BINDER_SET_CONTEXT_MGR already set [ 913.901385] binder: 2610:2613 ioctl 40046207 0 returned -16 [ 913.908303] binder_alloc: 2610: binder_alloc_buf, no vma [ 913.917483] binder: send failed reply for transaction 1934 to 2610:2613 [ 913.937185] binder: undelivered TRANSACTION_COMPLETE [ 914.028785] tmpfs: No value for mount option 'e¦U-ù¶dÍddTiýì”#óh‚B}Û¶mû8TeÔ“ꦾŽ€§\ð' [ 914.196099] tmpfs: No value for mount option 'e¦U-ù¶dÍddTiýì”#óh‚B}Û¶mû8TeÔ“ꦾŽ€§\ð' [ 914.231711] device nr0 entered promiscuous mode 04:48:58 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:48:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:58 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) symlinkat(&(0x7f00000004c0)='./file0\x00', r2, &(0x7f0000000480)='./file0\x00') set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="bd2b2b2a0000000400000000000000000000000100000000000000be000000000000000200000000000000000049a6de7c5ed3b714ee8caa9284c8fd3bdfd1d9ba4c63759a07ab4ca52bb2aac124cb33290dab0b49f7f225a9df"], 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5601039df973b53d859e769464fe24500000000"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f0000000740)=ANY=[@ANYBLOB="da4011289be44845084d057497ad96046d7e39df317d25b056f2717be2aa41208092d1313190ef285cdc968ec49ed179b048f1a86b9424e92f5d5d0a92cbcfb065a6552df9b664cd64645469fdec9423f36882427ddbb66dfb38540365d49315eaa6be128e809da75cf013"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) write$FUSE_OPEN(0xffffffffffffffff, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f0000000540)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x13) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000900)={[0x80000000, 0x1, 0x47, 0xffffffffffffffc1, 0x2, 0x80000000, 0x7f, 0xc6f5, 0x9, 0x3ff000, 0x5, 0x8000, 0x5, 0x0, 0x5, 0x8], 0x3000, 0x900}) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 914.330678] binder: BINDER_SET_CONTEXT_MGR already set [ 914.358065] binder: 2640:2641 ioctl 40046207 0 returned -16 [ 914.364155] binder: 2639:2643 got reply transaction with bad transaction stack, transaction 1938 has target 2639:0 [ 914.405533] binder_alloc: binder_alloc_mmap_handler: 2639 20001000-20004000 already mapped failed -16 [ 914.416480] binder_alloc: 2639: binder_alloc_buf, no vma [ 914.441703] binder: BINDER_SET_CONTEXT_MGR already set 04:48:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 914.461488] binder: 2639:2643 ioctl 40046207 0 returned -16 [ 914.480015] binder_alloc: 2639: binder_alloc_buf, no vma [ 914.496217] binder: release 2639:2643 transaction 1938 out, still active [ 914.496355] binder: 2639:2654 got reply transaction with no transaction stack [ 914.505543] binder: undelivered TRANSACTION_COMPLETE [ 914.544644] binder: send failed reply for transaction 1938, target dead [ 914.549541] tmpfs: No value for mount option 'e¦U-ù¶dÍddTiýì”#óh‚B}Û¶mû8TeÔ“ꦾŽ€§\ð' 04:48:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 914.710538] binder: 2664:2665 got reply transaction with bad transaction stack, transaction 1944 has target 2664:0 [ 914.746450] binder_alloc: binder_alloc_mmap_handler: 2664 20001000-20004000 already mapped failed -16 [ 914.769257] binder: BINDER_SET_CONTEXT_MGR already set [ 914.778357] binder_alloc: 2664: binder_alloc_buf, no vma [ 914.788583] binder: 2664:2668 ioctl 40046207 0 returned -16 [ 914.800332] binder: send failed reply for transaction 1944 to 2664:2665 [ 914.807868] binder: undelivered TRANSACTION_COMPLETE [ 914.831676] device nr0 entered promiscuous mode 04:48:59 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10002, 0x8) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000100)={r0, r2}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {r3, 0x4, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x7, @mcast2, 0xbae}}}, 0x118) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000400)={'batadv0\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="3f0000000000000000000000000000000000000045be3a3dff598564978ad7379584d20000a200000000000000000000000000000000000000000000"]}) 04:48:59 executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x200000) ioctl$SIOCX25SENDCALLACCPT(r0, 0x89e9) socketpair$unix(0x1, 0x4000004000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x400448ca, 0x0) socketpair(0x17, 0xe, 0x81, &(0x7f0000000000)) 04:48:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:48:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2, &(0x7f0000000080)="0adc1fdd9f12a40282b070") seccomp(0x1, 0x0, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x6, 0x0, 0x0, 0x50000}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = add_key(&(0x7f0000000100)='id_resolver\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="dadba6bc16203b69cf914ca48804fe9e8f8b404f75dc389308c2efb79e517faaa9b342176b96c1a36c02b9975c7d3c5741e201e53f8b99f175618b49cde5e0591fb9f904a024843b958340e155b93ad1bd360bd3a891f072b27272e6aeca04adf0355b6ab22af3ba059818b54e5dab6fa64a3bff31316f5b318b1a585b86053fbeef19024f", 0x85, 0xfffffffffffffffd) request_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f00000000c0)='cpuset\x00', r1) [ 914.974830] binder: 2675:2678 got reply transaction with bad transaction stack, transaction 1948 has target 2675:0 04:48:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0ad21f123c12a41d88b070") ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)) r2 = getegid() r3 = geteuid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r1, r3, r2}, 0xc) r4 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r4, 0x2203, 0x713000) [ 915.051535] binder_alloc: binder_alloc_mmap_handler: 2675 20001000-20004000 already mapped failed -16 [ 915.072861] binder_alloc: 2675: binder_alloc_buf, no vma [ 915.081704] binder: BINDER_SET_CONTEXT_MGR already set [ 915.083373] device nr0 entered promiscuous mode 04:48:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 915.125971] binder: 2675:2678 ioctl 40046207 0 returned -16 [ 915.125997] binder: send failed reply for transaction 1948 to 2675:2678 [ 915.154962] binder: undelivered TRANSACTION_COMPLETE [ 915.237460] binder: 2694:2695 got reply transaction with bad transaction stack, transaction 1952 has target 2694:0 [ 915.264507] binder_alloc: binder_alloc_mmap_handler: 2694 20001000-20004000 already mapped failed -16 [ 915.309628] binder: BINDER_SET_CONTEXT_MGR already set [ 915.315314] binder: 2694:2695 ioctl 40046207 0 returned -16 [ 915.338399] binder_alloc: 2694: binder_alloc_buf, no vma [ 915.346355] binder: 2694:2695 got reply transaction with no transaction stack [ 915.355300] binder: release 2694:2695 transaction 1952 out, still active [ 915.367104] binder: undelivered TRANSACTION_COMPLETE [ 915.387313] binder: send failed reply for transaction 1952, target dead 04:49:00 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) shutdown(r0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100), 0x4) r1 = accept4$inet6(r0, 0x0, &(0x7f0000000000), 0x80800) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) r2 = dup3(r1, r1, 0x80000) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffff9c, 0x10, &(0x7f0000000080)={&(0x7f0000000180)=""/235, 0xeb, 0xffffffffffffffff}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r2, 0x1bd, &(0x7f0000000280)={&(0x7f0000000040)=""/48, 0x30, r3}}, 0x10) 04:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:00 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x7fc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x444140, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0xc0000, 0x0) ioctl$KDADDIO(r3, 0x4b34, 0x9) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfd2e, 0x0, 0x0, 0xfffffffffffffff8) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x80000000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) capset(0x0, &(0x7f0000000080)={0x0, 0x41e49f14}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000000)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:49:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, &(0x7f0000000080)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e23, 0x100000001, @ipv4={[], [], @local}, 0x8000}}, 0x200000000, 0x8, 0x7, 0x9}, 0x98) bind$rose(r1, &(0x7f0000000000)=@short={0xb, @dev, @bcast, 0x1, @bcast}, 0x1c) 04:49:00 executing program 2: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x0, 0x2) bind$bt_l2cap(r1, &(0x7f0000000380)={0x1f, 0x3, {0x2, 0x9619, 0x80000001, 0x7e, 0x8, 0x6}, 0x6, 0x3}, 0xe) socketpair(0x19, 0x800, 0x5165a9ea, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/net/pfkey\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00000003c0)=@sack_info={0x0, 0x0, 0xfffffffffffffff8}, &(0x7f0000000400)=0xc) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000440)={r4, 0x9}, &(0x7f0000000480)=0x8) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r3, &(0x7f00000001c0)="f2eb58ae8a84fc1fd55ec873d861d51990315ce7e3a14b382aa2a5bb70eef7790143c543eaacbb", &(0x7f0000000200)=""/169}, 0x18) bind$tipc(r3, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x4}}, 0x10) time(&(0x7f0000000300)) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000, 0x2, &(0x7f0000ffd000/0x1000)=nil) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @remote}}}}, &(0x7f0000000000)=0xbf) socket$nl_crypto(0x10, 0x3, 0x15) [ 915.663221] QAT: Invalid ioctl [ 915.668254] binder: 2704:2706 got reply transaction with bad transaction stack, transaction 1957 has target 2704:0 [ 915.684532] sctp: [Deprecated]: syz-executor.4 (pid 2708) Use of int in max_burst socket option deprecated. [ 915.684532] Use struct sctp_assoc_value instead [ 915.697562] QAT: Invalid ioctl [ 915.726971] binder_transaction: 22 callbacks suppressed [ 915.726988] binder: 2704:2706 transaction failed 29201/-71, size 0-0 line 2816 [ 915.739453] sctp: [Deprecated]: syz-executor.4 (pid 2713) Use of int in max_burst socket option deprecated. [ 915.739453] Use struct sctp_assoc_value instead [ 915.767429] binder_alloc: binder_alloc_mmap_handler: 2704 20001000-20004000 already mapped failed -16 04:49:00 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000240)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r1 = syz_open_dev$sndtimer(0x0, 0x0, 0x38) pipe2(&(0x7f00000000c0), 0x800) socket$inet_sctp(0x2, 0x1, 0x84) syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x0, 0x400c00) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x10002, 0x0) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) getpgid(0xffffffffffffffff) ptrace$peekuser(0x3, 0x0, 0x3ff) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000480), 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000002a40)={{{@in6=@empty, @in, 0x4e22, 0x5, 0x4e22, 0x8, 0xa, 0x80, 0x80, 0x73}, {0x2, 0x7fff, 0x6, 0x0, 0x1ff, 0x101, 0x1, 0x4}, {0xfa4b, 0xff, 0xbf79, 0x7}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4d3, 0x6c}, 0x2, @in=@broadcast, 0x0, 0x6, 0x3, 0x0, 0x7b, 0x0, 0x3}}, 0xe8) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x1, 0x2) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) unshare(0x40000000) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) [ 915.789042] binder: BINDER_SET_CONTEXT_MGR already set [ 915.827268] binder: 2704:2706 ioctl 40046207 0 returned -16 [ 915.875265] binder: release 2704:2706 transaction 1957 out, still active [ 915.889542] binder: undelivered TRANSACTION_COMPLETE 04:49:00 executing program 4: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0xc00, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000100)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @remote, @loopback}, 0xc) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000240)={@multicast1, @dev={0xac, 0x14, 0x14, 0x1e}, @multicast1}, 0xc) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x100000001}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r3, 0x3cfb}, 0x8) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x10400003) [ 915.920202] binder_release_work: 27 callbacks suppressed [ 915.920209] binder: undelivered TRANSACTION_ERROR: 29201 04:49:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:00 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x40, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000001200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8800}, 0xc, &(0x7f00000011c0)={&(0x7f0000000180)=@getsadinfo={0x1028, 0x23, 0x100, 0x70bd29, 0x25dfdbfc, 0x0, [@sec_ctx={0x100c, 0x8, {0x1008, 0x8, 0x1, 0x7, 0x1000, "de90d4ee0a4f8110d914b4d6af130b7f54e58ced884454c9ffe5443e4f887396a0c9376be72f09351d9ec16ff2c2ebcfc601990dcda396372072e1c6eafdfe688ce472df03792159d4d809e7a97b7016b6863ad77da6538f8e6fa3006def729a47c01a941e77772b6d3b65e297e499d850549dda863e795015813ae24a10d1588e28ea316c3ff399e306833b6f7896de23b9c3507068784608715af8462e02eff2a589d107f5b042d10de715095db4107e83a40537853fb150e8c7009774d97313d1ecd060ccd24c0419d956ff5544f34d0469f211898818285f4f77f63a6c1fa402ee65195ca60644bcda679d0476523e65772cd05bc108c7cdfab7f69bc9fa984a9b11d3879b48280ee768da4f02cf81c6737639427923b59485a3ce28154f4497d038a8efc6fe48bfb00608f0d8c6d079dd7d3d5bf019aaa8a2e67b33e78280225fa45d9f95cb30686fc659d3dd59e77c49528b395bd927c1b0d20bd31ab3c3c6c14168b3bd50989e6c15c8b53441fa9218e3c97981cde1c283fe1890d870b3968970b0746c923d265c7741dc5c3f9172bede086262ed3df25e0c9fc378b71e66ad4dbe6303f1ebb991c57d9c7bc416da5528b5d0ecbaad4cb384eba5ece62e851ea9ee2898f0fd354d554cf517f6a99f77dd3f8f082596beeab93a743199a3ca0a93dd5fc80cce2c87c57ed05f1aa42707f0d8455ed0dda17e906962e9033964ddd6ebf234e19ca993523b9a947821b4d6f4a5650ab802ebb843a68b966ea388f4f5312f522bc2152d3de282b6e52552f5d586d6aa10feba15e92dbbbc10d60f70107d37d57bdbbc7716be8a7384930df8c76a47ff30d9366da538f7f8bbe9bc6b54a10d4934eedc985fe617526e994fb34a86bd7dbc36dcddbc9e3c4bd40a32fe0012d2ae9e6ca33176c0045f9f724da4561446ac8d041eec46743f45e9240451c15729bb37c546da078810d92e3d583d2af312f291608fbafeb5f036c384316f73a02cfc5af5132e4a68847d3c3acb5fa4e76779ae72381897661d4da51e94d0e41c3228ec2c19fa5a32d0535453671a7afc56a6d17e2924cef380c052c02ef80fe588872fddc5b687ee1e726786de6a155c2ba385c963aa2ac6140ea7490e8437c177b10fd2dc41b899eb7ee3730d7a057eba487b8a128c23784fa25be814b70e312cdceeccd921b2eda40dfb764e3b416c3f409d48d5746eb287840ccf2f1fcc4f068f283ec09e48f43ac779825c32a4971a30fec8737f6687fb66970669885b3a4dbbc67ce6e3e5ad76021c4ee8b03c5b03ec58470f89aca9a786dfc2d1f201f6a912dcf573e5461a51982c666e56ddfab303e3f97519e6dba2c49df4ff9aa6deb0628b30cda482b3ea3131569d1439ec22f9dd1c791147da41f531d3c33c0f1954f9b6d4ceaf5974c25ddf17dc72d8477f1f66df8b269a1daa8871bb00b4d9deff47928a0fefa16a6f45d72d1557addfd242347b9149a22cdb04a0eca588583ef41ba1ba16b8f61fde0bb747c1ebc3c6ca9d48cebc967c2dca8422ae7da0586547c716a712d70bf4d76a4782ef058f5490fdba8f4a6a8b15d6a7475f53252733a020dc46db28b0094700a6c1a524c4315abe9113f70445d38aa96a02765164d3e946f313f6b162e93ee18ce9fb3f0e31e45dba8192cf10a06a86d82cbef92d73307ec715be2647371d2c1aedbb995d48f6d9eb1363181d3e120d81e9d1c2f8ea44e7f1bf92d500fd2e115deda84a21635c6d99680d8942beffbe3c64549d260c9ac066804eefd14b3ae1687f771a5056c5e1fed5c1142399b9ac81e3699eca0202b6e4adba93aeaaf6d9c5caf92ba8ebd190a821440da492a132c9089c88f8dadb2d3848aadbb227aa173e6b4c4970bfb7a28ed9d3ad1e146d842a4c17a508f6efb7c961c816c84d801ed789c9f89cae0c18453fcbe0ca8cb5292a757bffeb18dbbfda7f46d258aa873e2e25ca688152d725e93ff006efc517ef49b445dde53be36a906d55af9d30526e1c777c7cd01f1b65d105a01a29b18c99c9a0a10a713b0ed32a93a344bdb4ae65fd2768ff656db4cdc79d8a2cd8cfbb2afb490c87e963d71e18acb2ab0d58058c8fde1c7659131b42b0653ef95dfb64c518c77503846e1e22e97f4bf237b8c01b0c251491f82af8f307750afb9879d21aa339717810f968a2d771ba082e7532e612f03a47997d05e6b05ac6a16e516f93cec5659f0a584e5cc175c6c7c18fc4d289671dd6751ad4b94ab159f1b6f31cdceb01a75c63c4b96e775c882c22e1714c9b07bff0ec871555965487623473d5f2d9d73ea2d69cf69ea2542e6d4a3ad18c563fcd29debe5a103b6bc8e8fe33ae282bd3ad22a6766e78e000f8e725cdd1ce360aa009a3b0d92b384d03d1dd67b4741c9918d4e217e6320ce3dcac0e001bd31cb8a6315f0138c86275fd2e59945cf5c5504c8f32058d9014a3c53a351fcf61eba06dd0b8442169320fb0f77f9701708e062f804943590e56a616a1e29bdcf0af1407843568ccd9a47b4f5c93a13f9947cb1e420529a8c009c59b5232b6a5ec075ed3cec106d354b63b8ad8464182b4cfe3b23232dd65f7a54230c79f9c63cd81770f860266c5e7c4ceff0885c14d0137de0544e20fda3a3a98a02a3df0d5845b621bf8b229a6b7433871acc6db8df33005a689f2ef3efa0351e7360d2a4d9bbcd203e68ea72d9ebfe762d300eb6d9b94f3c8c503baeb9258e5477a0fa94bed93771d1ee25e18fc52b3ae17fb9351fc1b4db0a9ff9367a28d0164cc1e5d868cfee692b583ee2f2b71d7c3a739c32a464997b891493bc11347a94756d8e1d28a1b8fb9cde20a2b77d004a9b4004c0e1916317d530c9caeb2d788bf4e27d2051de80b8300a065a82b13f7c140526f35a591511f78c0433bf66c47c00c1141073cc0b0ca84afb9f7705d93f27422eee0a03613e5bd329825eb0068e798304bce1292eb590c464d20155ce43b8dc203627b94f67a93f52189af6710c136c146dd5a264b6ffe6eda03e2af449439a30f0a79becddb2cf11bcc7e29fe409f22f8c1a0e36b4c4007f7d5ee55caf256877cbe1c6022720d3edc04ee1385af2462c4bef602b1c93ddfd7743544b2d7fe6e2c8536ee3bd381e29bcc9059dae0d0f86ce0ed03da3d9d3015e9fdf714639840f35060633c886852798dd280a0450ee10a50808517c0964fa44bfc7f1092468a8709fd5dc9b2604350830c77c8ebcf82d11b4423b73a2103e5c7e6ffdb599cb5dc4622b700e065178697b50ef0a3cf406e43515e37827e79f80c9e6b6a761aa06d37cc8d0d3ffd8a3d4a0b1423ce2793f150cb40a4e49e01530258fab05f662f31bc5d19c26ca350a05c76bc73851e299ff312909b7bb0fcc1fa2d2bb66d54d801df2525458e7427169b0ca84b97c6f049fc12d7929c9d33c46f82b9b4d786e1a4ac9184969d7e1d6def7b30859191f3eb493f9370a8757404c4c9bc128e35e5b0c5f5d408f5ab4dba12aecee5dc14ef44b1e1990a3385aa895210c8ca87a6ab865f10f2aa64308c6f10ec4edf4b71c38d8e0d33672317107f174cbae27445fa4fa6e4734edcc4513a36a4e2c78aa2efd5749d757be794be5c4dd5bf26dfe663d3ce3692d3603ab56a8855e863a778fa3c68440849b6635447b2098dd297dc936bb48ce816c9ccb93a0c5447b2c04efc73f8525b46da2107b5b51a0fbdd8cf73a10a66fdbef7f13ab005d9e0b9fe8739354ea4689cc20c09f9cb706e7db4d88d5e458563af133cf437b76775ecc37f96df3ea0d5efc93e2e1e87f9a09abfb9b5d0e93226bd4fce3559af6feaa04c07d2afb73f7cdea2e4cc3e834b5f6c1354945666de360d049d96feb42bda7d49507bc30bec4143066386509dc2f3621f8024f9bd6fae753725a176077c0f086aa99f6d26437b3fea6c28625d66b64136d3ee81a9ef2fa57462f4156d2bd26907d609b945a9963d8bbc9cc5707b56b9c5f9ce740c63d948fcc92f8beca6afa0f6d85343c0d110d07090509e6880694bfce76b4a9ccc8191b208dce11932a9d2e179e7e3eb3aa3a9ad187005368b64daf84bd60571561c0da71e728ac22de2fb8d5aa08ee62e1d37e0fad6029605b43a55b4647f5805a54802d992a1aed960124df546d0afa4bde62d8d3400d623d1eb0764eccdabccad15ed537c78299b1c6ec253ab059c2ad60a5c502237b2aa2049077c388e0dd001e881f28428b440bfe58a3df48868f67ab2be005f912cdfe247d221515be83031cfb82d7a215d460d8a290fc9200c95024b126ae910f8c030e68f4b4e4bfeaad919be08d917dd8eec48d229be38c13c60d81ae966b8de2a3d609eed87cfae1ab18ce8d977ae743f6033ceb43d8056a66d0ccea653829cb5703747a15fb354b37c7500fd00608bb760b5bdbf75fa58d033a4a9c387f42ed3151d17dcc88dc85f88806eff53a7aa1852ef7ce8204aa3e6d103a1667bbf5f8253c2e2f02e6ec578017e7196655f577e695bb250f1ccc4614f5bab572045aa3cacf7efe160fa5d98bb86b3e7c741541ed6923903d7e42007138836f40931923959f53d35f4b66c99e8cefb9700281193631fd140b18733756dc3f58beb4f9823bd74bd189b390ecca68eeeb23816f8a1cca5c7680090fcbd20fb0de64c021afde0cd43dee0b3533252511948c4997fe2617cee62fb068a7b887bfe8b465c633dfbff9c677f2516f84a6476b1e71be4b8a887b01ab092bcf05db7f06f29147167a27fb4f3aefbf0051ba5326f1d5afeacbedae1e60f85f6d0f366e1285f5dc642f89688ab411fea8775a8069dd8f51f003d1cf421950d365f9c143c0ac5c42200d217e84b5d2dad7c2fcecdd1f268650f22499b3634ee40d648720fc134cddfc1ca65431e9a8e9946f3016488383a77530e8d70d6c54b340141699f23ecfeccb8f8cfde1009493a3c15baa7a97fcb5f7535e64fdec4dbe48ad1c9c9d299972dc5cdb9d435c00a8dd8be6f9d882c9a29f9350b6903e84adecbb3d41b23b30e3aca8cd309b335ac5ca9d20d4e895e759d376ba320eee47cdd2a3dafa23c8076439f2c69f827f108d68c630a6e82b3fb9c2222853d90efe81c91aa0964d54313fbc7007aa8027598c2eebf16e56b90865a7ef1cb8e7e14ba90f2502e101c7f151b2e924d262f320d30d0e9b26fbb3f3decb38acac046e4035c4a5f90916d56b61f5d60dc097bf14427e8eb85edb3b939038334a1cc26cbb3d31b89fd7420538e1dd64769ebfae988a2bd4b496f0f22c08440768825b919f35ecdea9cc4ec7d670e8d71266939648eabbc81b068f2cb96171fa874b7fe5aac2f0c3fb7202369df4db23717d77d4d8953e608435f2e31f11697218009c501856bdc3369c6becdd6d6d5f124edc9fe45e3995266bbe364082d105dc6d7e19855b36f32090258bbf1aff62ca9d815a45016c6f83946a3649109a7bffdaaaaae247e434f58965ad24c1e5a96df9dd8cafdb4c21f99bb9dec3cb4c76cc7e2a9937155e3e9cdfc316dab833b4c34aa6f3167ede3436a76d4b5fff87dab81b02235bd88b94be73db517a37be7b326313f6cfbfba7aed54278893b6fc7e411f6b90ead34859fdcf416c82aa0a502e9947a21bbb8eec0bb6d927a513adbb0284ffa7fe05896232d71cf6ce9037dd6ff3467d8037ad375f1399ce19c674ca96548ff469bed47d1bebb2db7ee97ea3790c0142b08295fda0c88128bcfee6ffcd24d0b6c8e609c58170594fb11b3e1fd659fa4539bcb5edd98f2fff8452ae56361fab31532462503f18aa8e131c125df3bd6e02ad392c829"}}, @replay_thresh={0x8, 0xb, 0x4}]}, 0x1028}, 0x1, 0x0, 0x0, 0x4000804}, 0x0) recvmmsg(r0, &(0x7f0000001340)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000001280)=""/155, 0x9b}, 0x4d74}], 0x1, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x100, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x5, 0x200) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x400000000001b, &(0x7f0000001240)={@rand_addr, 0x0}, &(0x7f0000000080)=0x14) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000000c0)={r2, @multicast1, @multicast1}, 0xc) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f000000b000)={&(0x7f000000f000), 0xc, &(0x7f00005a6ff0)={&(0x7f0000451ccc)=ANY=[@ANYBLOB="3801000010001307000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f0000010000000000000000000000000000000064000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x138}}, 0x0) [ 915.963061] binder: send failed reply for transaction 1957, target dead [ 916.033815] IPVS: ftp: loaded support on port[0] = 21 [ 916.055230] binder: 2734:2736 got reply transaction with bad transaction stack, transaction 1960 has target 2734:0 04:49:00 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/net/pfkey\x00', 0x12801, 0x0) connect$tipc(r0, &(0x7f00000000c0)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x4}}, 0x10) ioctl$VIDIOC_ENCODER_CMD(r0, 0xc028564d, &(0x7f0000000080)={0x3, 0x1, [0x4, 0x1, 0x9, 0x200, 0x402, 0x89, 0x9, 0x1]}) setsockopt$packet_int(r0, 0x107, 0x1f, &(0x7f0000000040)=0x7ff, 0x4) connect(r0, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x2, 0x1, 0x3, {0xa, 0x4e22, 0x2, @mcast1, 0x1}}}, 0x80) accept4(r0, &(0x7f0000000100)=@xdp, &(0x7f0000000180)=0x80, 0x80000) setsockopt$packet_int(r0, 0x107, 0x1e, &(0x7f0000000240)=0x5, 0x4) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r1, 0x218, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4) getegid() [ 916.106686] binder: 2734:2736 transaction failed 29201/-71, size 0-0 line 2816 [ 916.128017] binder_alloc: binder_alloc_mmap_handler: 2734 20001000-20004000 already mapped failed -16 [ 916.138427] binder: BINDER_SET_CONTEXT_MGR already set [ 916.161025] device nr0 entered promiscuous mode [ 916.162653] binder: 2734:2736 ioctl 40046207 0 returned -16 [ 916.172233] binder_alloc: 2734: binder_alloc_buf, no vma [ 916.178570] binder: 2734:2742 transaction failed 29189/-3, size 0-0 line 3035 [ 916.186518] binder: 2734:2736 got reply transaction with no transaction stack [ 916.198054] binder: release 2734:2736 transaction 1960 out, still active [ 916.238763] binder: 2734:2736 transaction failed 29201/-71, size 0-0 line 2801 04:49:00 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x800) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000380)={0xb, @sliced}) [ 916.284592] binder: undelivered TRANSACTION_COMPLETE [ 916.289883] binder: undelivered TRANSACTION_ERROR: 29201 [ 916.296063] binder: undelivered TRANSACTION_ERROR: 29201 [ 916.301647] binder: undelivered TRANSACTION_ERROR: 29189 [ 916.307437] binder: send failed reply for transaction 1960, target dead [ 916.774667] IPVS: ftp: loaded support on port[0] = 21 04:49:01 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:01 executing program 2: futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000048000), 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) openat$nullb(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nullb0\x00', 0x80, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x81, 0x1) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000080)={0x9, 0x1, 0x1}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x16) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x100000001, 0x6, 0x9, 0x80, 0x20}, &(0x7f0000000180)=0x98) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r2, 0x2}, 0x8) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) 04:49:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_encap(r0, 0x11, 0xb, &(0x7f0000000000)=0x3, 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000f00)='/dev/vcs#\x00', 0x8, 0x5c7f90ffd61f7aa1) getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000f40), &(0x7f0000000f80)=0x4) 04:49:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair(0x0, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0x10000000d) perf_event_open(&(0x7f0000000900)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x6609, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@multicast1, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f0000000080)=0xe8) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f0000000240)={'security\x00', 0x3, [{}, {}, {}]}, 0x58) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f00000004c0)) setsockopt$RXRPC_MIN_SECURITY_LEVEL(0xffffffffffffffff, 0x110, 0x4, 0x0, 0x0) ioctl$SIOCAX25GETUID(r1, 0x89e0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000340)="b9800000c00f3235000800000f30660f388172de3e0f0626660f6a91f5fffffff30f078fc9a893be0a00000036f080a703000000dc0f01cfb9b0000040b800380000ba000000000f30150e000000", 0x4e}], 0xf2, 0x0, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cuse\x00', 0x2, 0x0) 04:49:01 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000240)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r1 = syz_open_dev$sndtimer(0x0, 0x0, 0x38) pipe2(&(0x7f00000000c0), 0x800) socket$inet_sctp(0x2, 0x1, 0x84) syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x0, 0x400c00) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x10002, 0x0) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) getpgid(0xffffffffffffffff) ptrace$peekuser(0x3, 0x0, 0x3ff) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000480), 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000002a40)={{{@in6=@empty, @in, 0x4e22, 0x5, 0x4e22, 0x8, 0xa, 0x80, 0x80, 0x73}, {0x2, 0x7fff, 0x6, 0x0, 0x1ff, 0x101, 0x1, 0x4}, {0xfa4b, 0xff, 0xbf79, 0x7}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4d3, 0x6c}, 0x2, @in=@broadcast, 0x0, 0x6, 0x3, 0x0, 0x7b, 0x0, 0x3}}, 0xe8) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x1, 0x2) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) unshare(0x40000000) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) [ 916.972606] binder: 2759:2762 got reply transaction with bad transaction stack, transaction 1965 has target 2759:0 [ 917.004321] binder: 2759:2762 transaction failed 29201/-71, size 0-0 line 2816 [ 917.107363] IPVS: ftp: loaded support on port[0] = 21 04:49:01 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 917.166317] binder_alloc: binder_alloc_mmap_handler: 2759 20001000-20004000 already mapped failed -16 04:49:01 executing program 2: syz_open_dev$video4linux(0x0, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000200)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000000980)={0x8, "7c70ee3800d5ab5f2036f872e0ac57cbd592bca0d671633f50a3102066d6e765f5a64731e3fb8d90d250eda2cc33b60a7ff98074cdc3f1dd1a2df26a381d95974e0925d521c6b48c3dee0d430d398884316091aff6adb6153dc3c92549957d3488efc02d6f6fb172524b095c30c1bd35aae04236bdd42694d613eb54c0b65a338c48dc4c8bad70754fc81d9928e4a1b81f9c77075258a0805b4494867247966b24a023311fd91ef3754b98d3acde6f2ef0617f123c22fccb81c11389fdfa2e21c2365aabfc8916e02151d8643ae21cab7fcbec6142186d3bb57546c106484bc4c28a48da2b75dd82aabe99464558e60cd101f6b65856fabee614d271741a68dd550c8772f06a93cf8e5c0de549c3b75a72f8a590bd50b2af5f64009c969ed7596f0192b0f98b1afac0e8c5f4c653f611b4a71776400a9ae3f18e75f856788c97195749042510735880b9bb0ccb23210832a4f1c6f134d68f8e299837c426e0c9a45d5d2c959446cc363f370c67cd01a063c91254d692fe35abee92fabda4f66d93228c979ebe036c5c2e0028ec76562d67d0919ca28258fec0ed60603142b5c57c4cfb1ea1e892d0fd2f33970142b179c415d6bea344fbcc82d133052e848a885160737c69eb02ca9f544831c8e3ffcf40cb7b415d24795fc8aaeb8e76bec262aea5e28fe5d6495c4b5895a612b1cc2122286add66356f3ecd309f970634f1b09da1507964d35575167317f13c7fd9f11af27ceea86e9a5b3494a27ba98ba38dd1fb72ef2c6163664fd8f7c946935cd4833121f505ff277c03d959d9a12f3389e9eb6701a8b29f72c20c6abb7bd8349dd2e120bdd59dca9f1a2a877f1677b59d7920ddf29b9d94f7c6879b78e31cf1b65b60fe349ef9d4976f46609ee34e33f647aafbf64f6323d18598905f2e73af75661397595b8f9c1e9a4e993946820da5378ca5b363560e95edce316e99bac6e6250efcf1cb58fdcf94c7557c2d7f763a688543462d54b64e178c2e64c6ebba356894973051907fd8de8ba908e822168b171c1707efcd9ac827e64313721876e2ff26ac34e88557a4a0dfde08eda81cf0c1465a89b68429e48966044c767563e1121db48c9b619fd7362afd15ec6aa19b28759d7977be4fbcad0cf8dd5dc5362259bd5cb5089a9d18db969afe1192571f5fcc0c4d6be281d23b9c1f9f32873c058adfa1bf57a3718686957edfd6e4b58aa959541127696d59fb2810d042ced227961eb19a424e4cf45bc6243217bb7561b7ee11f8c0b8f39480343a26f2da5fe79d5e213c01ea47155ffa91e7d7ba0bc8ccb018bd69cfe71dd8565a645d678b404a295397e83ae69dbf8505f6947a836b44823a92861124330fccd4bc4a2e20d9047bd919d82c89623caa87eb09bd584d58f42b35ef55fddc06dfb3957f3f507e5ca9b8b98947cc5bb68846755527ddf32ffa444e1c7a5654d4d377e04a9f22e1069804fdcdb251acb6bd6b32d100feb44286991d779d2b3e2b7f5cc5f8eb3ae166a3b6fb9df11e1867989a6f9b2028e4c73b4d418b51f6e870713cadafddb47a48c9a97283da214f02db3326d42438d9a7db580693ad1887f99d86bb5fafd6d07c2647fc80c2c5a1ed9ea3b95be65ca422080ddefca5b49ccd538f6bc67390f892d9e416f7e835f76dd90edc56256348d20560caeea05c0922cab60dbf0b57ddaaed6ded5a336e01485fd571dc12050461271cee347c31ac245bfee9128630dfcc43b6d88b5ba9937a6f6ab70b7d256784ff72297cfcfd0ffacd09b55fb832bf60f04d87c48c74972b9f18fa178ce4880b025d1c1097ddb929e8f7e02f1c0e03012bec0fa61a49eb1c2a50a45fc0d98b6649de325184006938e421321e8b366649d9b6ebadf77509c9d48844e80f7752fd7daaa5c938b946feaaac0d871203270a747035c7e2f697c84e792a55cbce76c0a25360f7acbeaab60627aa9c37064af75b67f46732844eb2f6b37226004afe451a9fbfbbcf7e72ade67b017e9209b5627fbe16789abd90326751a1fd1d93efc59f2650f979ba71938d784064922bee2874c4b76d5f26e39ea0a98cf175950137feff9456c88c6a295830183fae3a9c2312c25f3d81708d73488d15a587e7e7cdde3b77917eef29c8b5965c916a65c3c5a53b7313c3115d0a8bb4e16f6b80ff6f78adb756aba94ced86047562a2cd2fb25e9a4656f6359c3f2fde8b5ab38852853cbd7221cb4d59b7f0e79bd37f9ade073f62b75edbe63c13c0d02bf076d88f5b750ea640aad47ce97d6a0783398dd3fbb63734ed969470cf45200235650532224fc28caf1e36ca6b402ec4c978add40fc59f2113485875682139f8aa9aeb48d09178de919370b0cd0ebcab5e60e1b0a2fc153db0dae8e50b48561622a677d0f1afc149676f832e016e14007fb298dcb96f11a92a1ac8bd4cc7b34d659d6cd2c9817b586585e72080255b083bc84512277ffb7f561c6a7a08cd128bfe9b525da531f0bf04f11d3de102b3538835807ac0b2f4325fc6765d02d692ec82f5b338c8257029136fcd3427c09874ecc7492becdd6608eac4adf1abc3f7e08868a72e57ce4dcfc288a25af73d19f1118a9254963c1548cdca5fc7c921a7f218f8e71edd7969dfb35beae1091d7530e32236397fa9fcd232b441ff1b0177829468c198d659d247ccca4fbd58c625501e4368075d0e5e69a6f90952f5bbe48e85a303131dedf7f1a513b291598a545784e1013521877c25d6069d3a855652a4bad5b2df2e4da2de756a20e790b756dd2925ce824561e5892b5e064c7c7b996acc4e29597e0cd00956e9c57ec374714f846be7632d3075e38bead499163498810886c78a2cc73fb64fd48e186083ce911e0751b4dc63476859c2824fa532a4b1711c244619e702eeab19380aeb7b17f67fade3dcad8ddddd893a526cd5d04d8ae982c88029ec71bdd0772fd74adbdb378fc204ca411a2d8a50331516a28552be78f9725f32d1b3a6c7bdf3277c5f7e385c7ebbacc419ec7ca3c5b8f46dbefee59b6422a6b22d60527edc012f852077d925619874f7709f283e01678fed36528003a696ee431a817f34f453c143dc56b70e1f810a5380a555cc8c4fc6522ab544ce5d715caa302ebdd0aa8286b7ef5dd6dd48a8ad9566818f7509daf02db0b98b432f57f1d107ee95a86228728cab4062e27922381e1e2ee351af5e2ea0fd6d1cea70b3b8f4a50f0776fc9aa2a7d2dff6e1ea3769864104f09137b99960b69af13895d842649eacaed8ddf183beba3323640af8deb52b902c0974d685d19fc87c93eb80ad5d28e54363705ad39231d989522e94f000256bc8d93af138a45d67dad3e21fa9fb31d9327c6e71f61956d9daf4f97333112704136d3d1bf6fe0e4c002e10b684d2344300ec70fae0b50532ebace58f0e8318354a172cceacf27d01ff41cc8fef42443f62b0e15b5fcc0728630b96fb2c2b59634f4993bb1ce2eace6fb0f53e5f84bc5f58b1b66d59e3c75a98670496f105a703607211aa9e882e72f13e9fe07f0767ad4e5ac5c732b65301d8ceab36b5ff2f71958fb1b51d2e703ac506e68d4026160fd3f60440b8b8f554f1feeba5d53f71cbe60d143620f8fa779acb94c965b729207a5ab11f4a51b694c31606171da44a28d80cde296dff5724ff718d6377eb8534e616cff39af943ee4ce87b4fadded30c702d370a71072ab3e20f19b8c1b73fdbbb9c675352bb73ee85e22597fc0c439a33f5febe1629bd084af7193f8d1a1415b02ca54706711505cbae11ec6411b012cc3a3eddcfb002901b6e7565b9fbf4d605c147031888ceb590c14697d00970ce9095c6f7fee41ec6a15d7ef52dfedfff2a0d3dbb387b61232aee6ca202787038021e6aabda18e2adf6fd89aa491e65f9813d73412fbfff089752d713d7efa690ec4fc254b56908d3057f65997acf81aea589e272f8fa852849e488f1e0c0cb6cdb5f46ca92e36d39224e704850056d2e9b91909aed0f55d054e274415ecc39b8958335a14cfb0a42d7f26ef8e82592dfd03b3550b5193fba077994c682951968869574fd94976760d9bd9b334353eeda836cc8dab244e72095cc46833f02bb2f6df35601b3085664261abb67fc9ab9f27210e6827cd15ce16c55f0f7f5b8ab401f24032b19a53a9299b62ebf4a8cf7f4753d95126f008a8ce349036666de66bcaf40b27fa875efa98873e1ef9302e2a24bfe07bd1054bdf9ba9ad1b1075402f26d682833b947c762513ba5f07537bb712473184a60e04ace5adb8d982d6153b011ae0b2034adc0ff4a64e2c6561c2e0840cdab2120bc916cde9b7a92c4d332d0f83945fe55e3c8f4d93f22e7759c20241d92cca0ae5a3d06a127e5614df708cea1ad3b2f231c81460ff4c3f349c67a87135a4b67589ffce311832923f71796276e81f0537e265404c0ee06d5ed98a5ec5f8ad62db589eb585fc4627173b51fd4e897a3e8d2acbb82ec2996ac3a6823368a1e12a0536a9d1a7b2d31d80c46c292ff51395481d4f65c53fab867e27bec9156ee189d245d94877a1405dc9e1e996822ad47071a9ab36c9bfd02c41ea5ba21591793053b1b64758bae0addfcd69d169849bc1ee6ce5c08f0d3da5ecc1b6ab31e13af2fa5ce4d921163270901264a88ac6350e8fb6371663dd04146932238597258b123a8036250c190fbb3cfc6ebbf9e06c4a9053e8332c95c91a890a3d35ddd35f47e7ab606f3e345e12560e6d52243883da7b8910834042ad12e7fb3f08a0b14ef6aee22251999e6079be2ef5666d7d5ae00d161720262761da3f378c63cb151f4e94d034e9de949dfe796b905804ca555691023c30ea7cf0cb276e1e3ba65793291f8287d1064606bf5787421b9b9bfc05e9c5eac750de92519fe9e2592cd34a2ef6ec18efed5e7c13bfcfce47327cbecac358bbe6d44164849308cf91cd5ea87fa4b02ba4939e28141c7dad42714b019470d91808a8f46150677b6c90f267ecb39ef42afc95de0cbd016775c89d8213ec9d4e061e6493f237296f91abfc64176c0e885ef54af4136a724fadfe89a25d7599998acebc4a27f8fb5b26936bda5c3d5fec3373dcd9a0e99fc939641c50669adc54119582e8835575d1c57fa955cd29d870360620f91c3ff90d264013816352317ae226f7d7bad5db711f8973382f6cebd63cd519ddd08e1772649be75f64f4acc15f828dc0b305584b6dd2213194603c44e2964358d305aa97fb08568a0a955ad7a6f8d042754b4bbf2fb3414052719fd9841bef8360d1d3195c69414be882115c2c64fecdcbdaed3a2e943fdfef9a13520e41d32a787bcfe4f61e2b378d35aa70784a772cf8ebcaaeb105e4627516db2ababfcb8c11f224c3a48c86160d34d0ee59f02c31648ae4b0309b378f0bf63266967dcfb4f1cc1902f613c6d0d48915a9cf28a52b106544cde1b38ff2e2a1275fd0d3899ce7f7c6653c9017f7ac4aaa35bcb2811a8f9dbb56746b45475350e7c13d42abb5692377da7a4045ee644ce00f8699e3251d75621c82cd659ea3add277affe3ff792f7d24a3d0979ef82cfc0d409697ae2e8598854a8327f46974c901d309dc6dbe31913c59d821aa50c0fe95cc822e8f07bbb00e9a09bc9a570b9778d29308740bc336a41258d209c206f87a709aa43415da0096f7d177e509a7d625645fb098ccc45367d82235e952670ac5f82f8ced3f59fd9ee20ac75be609cc832417e807ddc40630cba4c91e0785edcb5f20b9e6dedb1ec172cd16fc034f410e9ce375ea855144aa3076317f649cf4efe4d7abf244984c4e", 0xfffffffffffffd14}, 0x10a9) sendmsg(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000300)={0x0, @in6={{0xa, 0x4e20, 0x480, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xffffffff}}, [0x5, 0x998b, 0x5, 0x7, 0x7, 0x3, 0x9, 0x6, 0x1, 0xfffffffffffffff8, 0x6, 0x80c0, 0x80000000, 0x1, 0x7]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000400)={r2, 0x1, 0x0, 0x9, 0x4, 0x4}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, &(0x7f0000000500)) ioctl$RTC_VL_CLR(r0, 0x7014) r3 = socket(0x5, 0x6, 0x70) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, 0x0) unlink(&(0x7f00000002c0)='./bus\x00') mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ff8000/0x4000)=nil) sendfile(r1, r1, &(0x7f00000000c0), 0x808100000000) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x48, 0x0, {"67c4ce35914c1d41cbe5aa428d5a9ea050c2ceb7770189c9ee58d95c908cb9db427303337a4a8f2b3da18e8cb3"}}, {0x0, "56ace3"}}, 0x0, 0x4d}, 0x20) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r3, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000140)='net/rt_cache\x00\xc6\xcd\xd9\xcc\x8b\xec\xfb\x7f=\xb7\xc9\x92~\bb\xa8\xf7\xb4\xa7') [ 917.211656] binder: BINDER_SET_CONTEXT_MGR already set [ 917.217705] binder: 2759:2762 ioctl 40046207 0 returned -16 [ 917.238474] binder_alloc: 2759: binder_alloc_buf, no vma [ 917.277885] binder: 2759:2783 transaction failed 29189/-3, size 0-0 line 3035 [ 917.416688] binder: undelivered TRANSACTION_ERROR: 29189 [ 917.429342] binder: send failed reply for transaction 1965 to 2759:2762 04:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x1ff, 0x7ff, 0x5, 0x10001, 0x49, 0x2, 0xfc, {0x0, @in6={{0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}, 0x40, 0x3, 0x1, 0x1f, 0x3}}, &(0x7f0000000000)=0xb0) write$cgroup_type(r0, &(0x7f0000000280)='threaded\x00', 0x9) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e22, 0x3, @mcast1, 0x81}}, 0x9, 0x5}, &(0x7f0000000240)=0x90) unshare(0x40000000) [ 917.478220] binder: undelivered TRANSACTION_COMPLETE [ 917.502833] binder: undelivered TRANSACTION_ERROR: 29201 [ 917.562728] binder: undelivered TRANSACTION_ERROR: 29189 [ 917.573598] binder: 2792:2794 transaction failed 29201/-71, size 0-0 line 2816 [ 917.660218] IPVS: ftp: loaded support on port[0] = 21 [ 917.668686] binder: BINDER_SET_CONTEXT_MGR already set [ 917.679451] binder_alloc: 2792: binder_alloc_buf, no vma 04:49:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0a45215c3e00000000b03018691a1ace8b9e8547d4992b0b19e4f680d3019142ef18963f89638a2c6b950a235b26b33e7178bfa4b87a419da23b2c0b4051e6bd5a8f1511dad039d1f11df14502a8a08000133a189404b79960c2d8a22d478fd059eb611ff8ec4da523b441b28d804856a01145af20db2faad96ea9d3ae688b3913c21fb5f8aee068c9af38e188a5de8259750e34be2df30bc99606b5cfee7830b6879baa9f56121dacfae5c99a5a82d697e2111761fd32c2351aea081ab17e0dd44010fb57a1346eec30d5fb6631acb36b2a6b6110a446d8f024acadd7d39f7fe45aff5d6f5d6120fd33769c60300b0c15df857d0780b0e3cedceba57d35bdc806862b659f7c3b10886ade26f863c152870b0428b4a3db6410503ed3dee9c0ff3c24c1b59975c52a2f4744ce8c2481194e5bdcee5ff76bc5a9ae7443c10faaba9a9f7089f9fc691c5c2ab93322d3ea7880a50ebd69ab5dec2fa376d6e69e84c127d59f5779a56b15ce2370bf374b8f") r1 = socket$inet6(0xa, 0x803, 0x3) listen(r0, 0x1ff) ioctl$int_out(r0, 0x2, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'bridge0\x00\x00\x01\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x44100, 0x0) preadv(r2, &(0x7f0000001440)=[{&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/170, 0xaa}, {&(0x7f0000001340)=""/223, 0xdf}], 0x3, 0x0) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, &(0x7f00000000c0)=0x7) accept(0xffffffffffffffff, 0x0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001480)='/dev/video37\x00', 0x2, 0x0) [ 917.753106] binder: release 2792:2794 transaction 1969 out, still active [ 917.760922] binder: 2792:2794 ioctl 40046207 0 returned -16 [ 917.775498] binder: undelivered TRANSACTION_ERROR: 29201 [ 917.787737] binder: 2792:2797 transaction failed 29189/-3, size 0-0 line 3035 04:49:02 executing program 3: openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 917.833322] binder: undelivered TRANSACTION_ERROR: 29189 [ 917.838999] binder: send failed reply for transaction 1969, target dead 04:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 918.031023] bridge0: port 2(bridge_slave_1) entered disabled state [ 918.038878] bridge0: port 1(bridge_slave_0) entered disabled state 04:49:02 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 918.081975] binder_transaction: 1 callbacks suppressed [ 918.081991] binder: 2806:2808 got reply transaction with bad transaction stack, transaction 1973 has target 2806:0 [ 918.121177] binder: 2806:2808 transaction failed 29201/-71, size 0-0 line 2816 [ 918.138654] binder_alloc_mmap_handler: 1 callbacks suppressed [ 918.138672] binder_alloc: binder_alloc_mmap_handler: 2806 20001000-20004000 already mapped failed -16 [ 918.193977] binder: BINDER_SET_CONTEXT_MGR already set [ 918.211032] binder: 2806:2808 ioctl 40046207 0 returned -16 [ 918.218323] binder: 2806:2816 transaction failed 29189/-3, size 0-0 line 3035 [ 918.233615] binder: 2806:2808 got reply transaction with no transaction stack [ 918.241248] binder: release 2806:2808 transaction 1973 out, still active [ 918.257713] binder_release_work: 1 callbacks suppressed [ 918.257718] binder: undelivered TRANSACTION_COMPLETE 04:49:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 918.300455] binder: undelivered TRANSACTION_ERROR: 29201 [ 918.326216] binder: send failed reply for transaction 1973, target dead 04:49:02 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 918.431479] IPVS: ftp: loaded support on port[0] = 21 [ 918.459959] binder: 2824:2825 got reply transaction with bad transaction stack, transaction 1978 has target 2824:0 [ 918.492187] binder_alloc: binder_alloc_mmap_handler: 2824 20001000-20004000 already mapped failed -16 [ 918.512842] binder: BINDER_SET_CONTEXT_MGR already set [ 918.530008] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 918.530015] binder_alloc: 2824: binder_alloc_buf, no vma [ 918.552512] binder: 2824:2825 ioctl 40046207 0 returned -16 [ 918.561637] binder: release 2824:2825 transaction 1978 out, still active [ 918.562097] binder: 2824:2832 got reply transaction with no transaction stack [ 918.579419] binder: undelivered TRANSACTION_COMPLETE [ 918.604995] binder: send failed reply for transaction 1978, target dead 04:49:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 918.731313] binder: 2834:2835 got reply transaction with bad transaction stack, transaction 1983 has target 2834:0 [ 918.750180] binder_alloc: binder_alloc_mmap_handler: 2834 20001000-20004000 already mapped failed -16 [ 918.755093] device nr0 entered promiscuous mode [ 918.760496] binder: BINDER_SET_CONTEXT_MGR already set [ 918.770807] binder: 2834:2835 ioctl 40046207 0 returned -16 04:49:03 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) 04:49:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 918.777551] binder_alloc: 2834: binder_alloc_buf, no vma [ 918.783830] binder: release 2834:2835 transaction 1983 out, still active [ 918.792884] binder: undelivered TRANSACTION_COMPLETE [ 918.812614] binder: send failed reply for transaction 1983, target dead 04:49:03 executing program 1: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000740)='/dev/zero\x00', 0x0, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/loop-control\x00', 0x0, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000080)={0x1f, 0x7, 0x2, {{0x12, 'selinux,cpusetppp0'}, 0x80000000}}, 0x1f) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000540)=ANY=[]) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000000700)='user\x00', &(0x7f0000001bc0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) read(0xffffffffffffffff, 0x0, 0x0) rt_sigpending(&(0x7f00000001c0), 0x8) statfs(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000180)={0x0, &(0x7f0000000100)}) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) fcntl$setpipe(r0, 0x407, 0xffffffffffffffc3) 04:49:03 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) [ 918.993568] binder: 2840:2844 got reply transaction with bad transaction stack, transaction 1987 has target 2840:0 [ 919.040926] binder_alloc: binder_alloc_mmap_handler: 2840 20001000-20004000 already mapped failed -16 [ 919.060911] binder: BINDER_SET_CONTEXT_MGR already set [ 919.076425] binder: 2840:2844 ioctl 40046207 0 returned -16 [ 919.092233] binder_alloc: 2840: binder_alloc_buf, no vma [ 919.105755] binder: release 2840:2844 transaction 1987 out, still active [ 919.117419] binder: undelivered TRANSACTION_COMPLETE [ 919.138905] binder: send failed reply for transaction 1987, target dead 04:49:06 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bcsf0\x00', 0x43732e5398416f1a}) pread64(r0, 0x0, 0x0, 0x0) 04:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:06 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) 04:49:06 executing program 3: openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:06 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x40247007, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) set_thread_area(&(0x7f0000000580)={0x7a, 0x20001800, 0x4000, 0x200, 0xffff, 0x1, 0x101, 0x2, 0x843, 0x3}) rename(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000480)={0x2a, 0x4, 0x0, {0x1, 0xbe, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) mount(&(0x7f0000000640)=ANY=[@ANYBLOB="539b9105ab1072c24e2b98df1388f1adc93f6cb6cd0000000000000000000000000000"], 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000d04000), &(0x7f0000000680)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="969957b52d30fea3a6945a209691fd3e214cb9dcc33db7762efad2628dcef5d3b6364e601019df973b53d859e769464fe2a2410d59da45"], 0x0, 0x0, 0x80010, 0x0) mount(&(0x7f00002b9ff8), &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) r3 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0x5) write$FUSE_OPEN(r3, &(0x7f0000000380)={0x20, 0x0, 0x8, {0x0, 0x1}}, 0x20) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000500)=ANY=[], &(0x7f00000006c0)='./file0\x00', &(0x7f0000000800)='devtmpfs\x00', 0x847, &(0x7f0000000780)) preadv(r1, &(0x7f0000001400)=[{&(0x7f0000004200)=""/4096, 0x9d}], 0x1, 0x2) ioctl$int_out(r2, 0x2, &(0x7f0000000700)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='./file0\x00') ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) utimes(&(0x7f0000000440)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'}) fcntl$setflags(r0, 0x2, 0x0) 04:49:06 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x193442, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000080)={0x8, {{0xa, 0x4e22, 0x7692, @empty, 0x723800000000000}}}, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f00000001c0)="0adc1f123c12961d88b07084c9c63b8261e237f6ef48d0a791c9ecfeb1c9ddaa0d6744169c657d0296060350ef3d658052472dfc08d6482c2737b965d8830b7d44235c9d434ecdb67fb6c6b8e4edfd9dc8311bdc49201e779cd3cb30") socket$pptp(0x18, 0x1, 0x3) ioctl$sock_ax25_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, 0x7, [@default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default]}) [ 921.859578] binder: 2858:2861 got reply transaction with bad transaction stack, transaction 1991 has target 2858:0 [ 921.911201] binder_transaction: 8 callbacks suppressed [ 921.911221] binder: 2858:2861 transaction failed 29201/-71, size 0-0 line 2816 04:49:06 executing program 1: pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) close(r0) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x20000, 0x140) ioctl$KDDELIO(r1, 0x4b35, 0x1) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) r2 = inotify_init() mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000bae2c66cfed0328ab84b00", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000100)) [ 921.988490] binder_alloc: binder_alloc_mmap_handler: 2858 20001000-20004000 already mapped failed -16 [ 922.012992] binder: BINDER_SET_CONTEXT_MGR already set [ 922.018738] binder: 2858:2861 ioctl 40046207 0 returned -16 [ 922.025416] binder_alloc: 2858: binder_alloc_buf, no vma [ 922.031181] binder: 2858:2873 transaction failed 29189/-3, size 0-0 line 3035 [ 922.038963] binder: 2858:2861 got reply transaction with no transaction stack [ 922.071924] binder: release 2858:2861 transaction 1991 out, still active [ 922.086331] binder: 2858:2861 transaction failed 29201/-71, size 0-0 line 2801 [ 922.098188] binder: undelivered TRANSACTION_COMPLETE [ 922.116705] binder_release_work: 9 callbacks suppressed [ 922.116711] binder: undelivered TRANSACTION_ERROR: 29201 04:49:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:06 executing program 5: mkdir(&(0x7f0000000000)='./control\x00', 0x0) r0 = creat(&(0x7f0000000300)='./control/file0\x00', 0x0) readlinkat(r0, &(0x7f0000000040)='./control/file0\x00', &(0x7f0000000080)=""/127, 0x7f) rmdir(&(0x7f0000000140)='./control\x00') [ 922.147672] binder: undelivered TRANSACTION_ERROR: 29201 [ 922.149403] device nr0 entered promiscuous mode [ 922.159645] binder: undelivered TRANSACTION_ERROR: 29189 [ 922.173833] binder: send failed reply for transaction 1991, target dead 04:49:06 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000200)=0x401) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x220200, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0x0, 0x0, &(0x7f00000002c0)) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f00000001c0)) fallocate(r2, 0x0, 0x6, 0xfffffffffffffc00) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, 0x0, &(0x7f0000000280)) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)=ANY=[@ANYBLOB="0000050001008100050001008f00"], 0x1) sendmsg$nl_generic(r3, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f, 0x0, 0xfdffffff}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc, @pid}]}, 0x1c}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) r4 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r4, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r4, 0x9) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x0, 0x84) sendto$inet6(r5, &(0x7f0000000100)='F', 0x1, 0x7, 0x0, 0x0) 04:49:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x4, 0x4) syz_mount_image$gfs2(&(0x7f0000000080)='gfs2\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)) [ 922.321473] binder: 2883:2889 got reply transaction with bad transaction stack, transaction 1996 has target 2883:0 [ 922.357985] binder: 2883:2889 transaction failed 29201/-71, size 0-0 line 2816 [ 922.390628] gfs2: not a GFS2 filesystem 04:49:06 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) mount(&(0x7f0000000140)=ANY=[], &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='tmpfs\x00', 0x0, &(0x7f000000a000)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$btrfs(&(0x7f0000000240)='btrfs\x00', 0x0, 0x4, 0x0, &(0x7f0000000940), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="e0cbc9fb8d5eb2b8642c59b702000000000000006f6f743d002c00"]) syz_mount_image$ntfs(&(0x7f00000003c0)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000880)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) chdir(&(0x7f0000000140)='./bus\x00') creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000c00)={0x7, 0x5}) mount(&(0x7f0000000100)=ANY=[], 0x0, &(0x7f0000000840)='\x00\x00\x00\x00\x00\x00o\x9d\xd7\xdb\xe2\x80\x83\x95\x12\x94\x19\xfcO\xd2\\\x9e\xc6b\xc9\xd8\x9d\t\x10\xbb\xab\t\xdc\x83cE\t\x9dh\xc1od\x18c\xdd7\xd4\xe0R\xe8\"H\xce\xcd{\xd6\x0f\xc9\xb5\xf5\xd3\x03&\x12\v@\xf0\x8e\xebm\xef%\fI\x107\xfe\xdd\x93P\f@\b;\xc1\x87\x9dr-\x1f\xcb\x87\x1b;\'\xe5}\x98\xee\xe0j\rIDT\xb3\x8c\x85\xaf\xde\'\xb2\xc1~\xeb1PA\xf5UT:i\xae\x02RMCl\x97!hE\x87!\xe8\x98\"2\x97\x06\x16\xf7\xd8\xf76o\xd5\x94\x14\x90\xd4{f\xa0Y\xe4L+\xca\x89\x92 \xe8\xd0s\xdclI\x15\xa3\x8a4\x9a!\xe1\xac\x88\xbbC; \xbd~\xeb\xe6\xe7&\x12\xda\x89s#7\x96\x8b', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x526, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) personality(0x4000009) mmap(&(0x7f000030b000/0x1000)=nil, 0x1000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000400)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000380)='./bus\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r2, &(0x7f00000002c0)='./file1\x00', r3, r4, 0x1c00) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000980)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec\xad\x1b\xa2\xf4x\x1d\x9f\xf5\xda\x9a\"\xf97\xf4i\x91e\xd5f\xbf7N\x13\xbe\xbe\ve\x82\xa1\xd2b\x06\xb5\xebt\xb1b\xefd\xb0\xecbf\x96\xd4\x88\x99\xeeh\xc5$\xc3\xf4D\xac\xc4P\xe3\x98R\xef\xf4\xdb\x017\xef\x90\'n/\x88\xae\x93\vx\'\xdf]A\x97\x99\xadr\xdcvw\xbf\xac\x9e=\xe1\xd8P\xea\x10}\xdbC\xab\xae\xf9\xcfS|\x9ce\x12\x8eV\xa8\xd2\xc7\x9bJ', 0x0, 0x0) stat(&(0x7f0000000940)='./file1\x00', &(0x7f0000000b80)) fcntl$notify(r5, 0x402, 0x80000018) fcntl$notify(r2, 0x402, 0x10) mmap(&(0x7f0000338000/0x3000)=nil, 0x3000, 0x800002000003, 0x13, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000400)={0x9, 0x4, 0x6d79}) perf_event_open(&(0x7f0000000080)={0x4, 0x70, 0x6, 0x0, 0xd85d, 0x10001, 0x0, 0xfffffffffffffffb, 0x0, 0x2, 0x5, 0xff, 0x3, 0x1, 0x7fff, 0xffffffffffff8001, 0x10000, 0x5, 0xe3a, 0x45, 0x0, 0x4, 0x6, 0x4, 0x0, 0xd0f0, 0x0, 0x2, 0x4, 0x6, 0x0, 0x1, 0x1ff, 0xb9, 0x9, 0xffff, 0x200, 0x0, 0x0, 0x9, 0x1, @perf_bp={0x0}, 0x10, 0x4e, 0x67cbdd72, 0x6, 0xffffffff, 0x996}, 0x0, 0xd, 0xffffffffffffffff, 0x2) [ 922.419462] binder_alloc: binder_alloc_mmap_handler: 2883 20001000-20004000 already mapped failed -16 [ 922.477940] binder: BINDER_SET_CONTEXT_MGR already set [ 922.502049] binder: 2883:2889 ioctl 40046207 0 returned -16 [ 922.524418] binder_alloc: 2883: binder_alloc_buf, no vma [ 922.532346] binder: 2883:2905 transaction failed 29189/-3, size 0-0 line 3035 [ 922.607290] overlayfs: failed to resolve './file1': -2 04:49:07 executing program 4: ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000000c0)={0x6}) r0 = socket$netlink(0x10, 0x3, 0xf) writev(r0, &(0x7f0000fb5ff0), 0x4c) fcntl$getown(r0, 0x9) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000180)="1f0000000203193b000007004000068100023b050900020000004042020058", 0x1f}], 0x1000000000000052) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x400000, 0x0) connect$pptp(r1, &(0x7f0000001980)={0x18, 0x2, {0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1e) 04:49:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 922.633822] binder: undelivered TRANSACTION_ERROR: 29189 [ 922.643113] binder: send failed reply for transaction 1996 to 2883:2889 [ 922.652970] binder: undelivered TRANSACTION_COMPLETE [ 922.660220] binder: undelivered TRANSACTION_ERROR: 29201 [ 922.669157] binder: undelivered TRANSACTION_ERROR: 29189 [ 922.754057] binder: 2907:2908 got reply transaction with bad transaction stack, transaction 2000 has target 2907:0 [ 922.791368] binder: 2907:2908 transaction failed 29201/-71, size 0-0 line 2816 04:49:07 executing program 3: openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 922.841757] binder_alloc: binder_alloc_mmap_handler: 2907 20001000-20004000 already mapped failed -16 04:49:07 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_cpus\x00', 0x0, 0x0) write$P9_RMKDIR(r0, &(0x7f0000000100)={0x14, 0x49, 0x1, {0x81, 0x0, 0x4}}, 0x14) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) write$9p(r1, &(0x7f0000000080)="0d6da8af25a7592174b2b8d25071bdf871b17b834bbe237537b80cfb498909ff48c64decbdfc9b470469", 0x2a) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000029c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_GET_PIT(r3, 0x4020ae76, &(0x7f0000000000)) 04:49:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file0\x00', 0x166) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000080)=0xc8) r1 = socket(0x200000000000011, 0x803, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'vaan0\x00', r2}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x8, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000a80)={@mcast1, r3}, 0x14) open(&(0x7f0000000a40)='./file0\x00', 0x200, 0x4) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0x6}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000540)={0x0, 0x80000001}, &(0x7f0000000580)=0x8) sendmmsg$inet_sctp(r1, &(0x7f0000000e00)=[{&(0x7f0000000240)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000280)="95f1c157c45a7752edcf76efd13704ed8b8f026c6c4c671eb3751b1875887c57e991e21652072682532bc1e15f6a246c0ef85c32cdb3106e5c007caa32af1544276e7954bc571841846025790b6717c0a3c7408665f9815418a5a5a9f3b5f9d702476c5b5e81bc08d439f8f0142148034c67600b80d35ffcd78c120e4b3a3e2d227675e41c4101aef5663688cd053986a3f486dd5a91d23fa2bf1f02aeaebae76dcc232a645ca7e1d714d47a", 0xac}, {&(0x7f0000000340)="bb5497ed5a2bc5e119647d180640cc7210889defc97826ba9db1adaad03142fbee15ac91fa49b68fb0d8c3f165779ec3bf988e00564ee41e9d6f76f9c3a233baf27ba7fbdac14bba0d01e31a4819b4f0485cc2e673c516bc", 0x58}, {&(0x7f00000003c0)="2f81dce6ac7eebb5fe6c340c1c634a6eb8f63b2d7f62d80b74173fa3c36063851d36d887332d7f8bf20e4740c80de743a9a0ef841c2676fc7d25f90835715194f66cf30357a70e146d2a1d990225a8c976c2de8969aec7a61830c4cb79d39c46a2ad803be1210ebbad45de6afe012b31d73b3fe2d8c7ba131f45f87e70272ef2695b2e69b1db01eda609ac50106148e4c4d5da79c2a21def9da08c678fb6f4", 0x9f}], 0x3, &(0x7f00000005c0)=[@sndrcv={0x30, 0x84, 0x1, {0xb0a5, 0x125, 0x1, 0x3f, 0x8, 0x5, 0x9, 0x1, r4}}, @sndinfo={0x20, 0x84, 0x2, {0x7c5ecc38, 0x8000, 0x1, 0x4, r5}}, @dstaddrv4={0x18, 0x84, 0x7, @broadcast}], 0x68, 0x40000}, {&(0x7f0000000640)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000c40)=[{&(0x7f0000000680)="07934a09b74ac96e5cd336f226ba216b83c2f6ae2b1e07888660594d07aa97afed99d06c318595ebf0f51fb947f9e376f53ec913847c2ce92c48b75f1835fc92cbb3f1d2004c05ec522dec1237a6634fe6c01745edf908eccd28ab9d9b0b44aed9497a426261c49194c16e5dd03df23a656a5d7603990ebba85c9ab361146786bcbd8bcfc6382faa94ddad625db031126ab04b0c1c40a6926962a580d146", 0x9e}, {&(0x7f0000000740)="d83a370b2ea74fe64821674bd94372ed75c3aafa933eb9086ce2314e352bd80ac8287506cfdaf37faf38b59a98a1972bcb17deec2eba43e36488af11bc9aed74c0bdf8f8771fa9a5cb0a7f2bbf0bcd5745f1a51da5749d1a46bdde240840cc4ebc6196164ed31949d84bcebb4c93941aaf8e24cb0305d66f3fed7f0bdbaa6ac746a8697442da0e07258fda2aed56159ba2973ca03ea1f8365fad16f47579464e01b3e15328408c4cb166ee37a069291157a5001940", 0x43}, {&(0x7f0000000800)="95d68d01bbc289c5e23d3d3ef62e7a3e611e17909f63ebbdedb7a560fc63ea3a5e38303c59a7a1020c838e3ace13e157eefe48339cf68894786ad0ad303731d6c5b5e9a13f88f9cc7ed091049ab1cdc15ccc01af3af86ba3a37f44e45c3f0898ca0cf742c59be58fdc1363376223f5ae12da419efdf0a0f67d2fe0e7a98e7ea9f0f7c69ea9b6e9812c67842583c190d655ea9401864efcb2c8afaa9d996701948448de8817088c0a24e6f411970b216049e6444e15a53cd1995ed4c929f66e7c84d400179722c7be9d71f7fef481ec451810dca7", 0xd4}, {&(0x7f0000000900)="38f6c6f8ce8036f76db51e0bea092fef76452886218c8024c4af0c1793012ba7a68ec91e96cfe2a2df58ca7fc7da3e70bd5b615c4be2af70e60b87fc472327464cbc91695b467fb4db97af26c2274f50848d59e82af5e754df59177f2a20cf9de0cc1f070a66b83f2a0f4d177d2f2ec23c864a6b1cb31d895ec2d7ec90048e6ebae3c3bd8a0d877ef66cf9670df3e8d1b51de5e2a5a9eed3c90628dc3434000150ed5317fc451dcb5148c53b560583ac5d814cf5191754235c57525476d0bb2199cc3883c4cb162bf37cd6bbda", 0xcd}, {&(0x7f0000000a00)="d5ed00bb", 0x4}, {&(0x7f0000000ec0)="4e49b5eb93b7cc89f501cecee1885051148e437a347a79edaf04fa0e65a3a31c751eb43a6e99b82f4e93d57c5e26b9386451cdc7229841d63c8ef5eebf70ed29dbc2783449caf6d7873568eb452b962a9a6b828d311fd4ce79640725df6c6ae92b7b2a2786cb5b6e58204b802c5f50b81eb0d48b93d7f28dee8df42505ab355486da6a71da14183deaf31cc9f927cced1eb38d700cf5a4671e9e94ad72304bf305f191fd84b7e7593f19e18663ac31c6f11e354fd9a8528e5451f82002b4b988c5e015848a0770dfa6bf6cc345df0993293202376536dcd6020dd37b8ee5102775ba5091f8d74d8e18", 0xe9}, {&(0x7f0000000b40)="fa2550482ae81141f494feca889f695d3d1d7699d787bf7d85f6d2fdcca75531e417184c811956ac2e5953b119d215310643ab450026688518316a1ae42d33daf60e3222c666157bd9184fa2b17afb59a1", 0x51}, {&(0x7f0000000bc0)="0fba3c61c8a8e73e88043da08c59d7eebe600b56bd60d382e2ab1b5cfddd37b88be351c7db46c410a012c2dcee0863d866b04f2b3e1ded222df691437e21e13dfe36c0b1327c9fc0c5e5", 0x4a}], 0x8, &(0x7f0000000fc0)=[@dstaddrv6={0x20, 0x84, 0x8, @mcast1}], 0x20, 0x4000040}, {&(0x7f0000001000)=@in6={0xa, 0x4e22, 0x80000001, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}, 0x1c, &(0x7f0000000d80)=[{&(0x7f0000000d40)="204b0dad67b2434212eed25ebc", 0xd}], 0x1, &(0x7f0000000dc0)=[@init={0x18, 0x84, 0x0, {0x3, 0x1, 0xdab3, 0x2}}], 0x18, 0x4}], 0x3, 0x0) [ 922.912718] overlayfs: failed to resolve './file1': -2 [ 922.980777] binder: BINDER_SET_CONTEXT_MGR already set [ 922.994875] binder: 2907:2908 ioctl 40046207 0 returned -16 [ 923.016933] binder_alloc: 2907: binder_alloc_buf, no vma [ 923.060063] binder: 2907:2913 transaction failed 29189/-3, size 0-0 line 3035 [ 923.062622] binder: release 2907:2908 transaction 2000 out, still active [ 923.106102] binder: undelivered TRANSACTION_COMPLETE [ 923.143985] binder: undelivered TRANSACTION_ERROR: 29201 [ 923.162616] binder: undelivered TRANSACTION_ERROR: 29189 [ 923.180977] binder: send failed reply for transaction 2000, target dead 04:49:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:07 executing program 2: ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x1}) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x6}) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='trusted.overlay.opaque\x00', &(0x7f00000003c0)='y\x00', 0x2, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x200) bind$tipc(r2, &(0x7f0000000280)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x2, 0x1}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r4, 0x110, 0x2, &(0x7f0000000100)='xfs\x00', 0x4) r5 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x1000000000040000, 0x4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000440)={0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x88, 0x0, &(0x7f0000000580)=[@increfs={0x40046304, 0x2}, @register_looper, @exit_looper, @increfs_done={0x40106308, r6, 0x1}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000480)=[@fd={0x66642a85, 0x0, r3, 0x0, 0x4}], &(0x7f00000004c0)=[0x20, 0x0, 0x78]}, 0x18ac}}, @increfs={0x40046304, 0x2}, @clear_death={0x400c630f, 0x4, 0x4}], 0x94, 0x0, &(0x7f0000000640)="bc3e62ed07b5dad521e6fc9e5bd3a42952d7f8882544ea7d67c457734ac05d2c2dfd9ac09521c95b08069d9063ef905431e6709a9cd3778944a0c0955432a409b72a58900a8a2df35341d8e1eab411dbb7e6e4e3958b993f1b1d0b1c25b369306ac8d93bd4f26bb9e31517afd7b316affe436111cd15cc7aa6c462914a8cf211dc2b9bf3594146989581b05931afec2605c3c282"}) setsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000200)=0x100000000004, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) write$UHID_DESTROY(r7, &(0x7f00000001c0), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r7, 0x7001) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x3) getsockopt$inet_mreqn(r5, 0x0, 0x24, &(0x7f0000000540)={@multicast1, @empty}, 0x0) ioctl$RTC_AIE_OFF(r7, 0x7002) connect$inet(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$xfs(&(0x7f00000000c0)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x7f, 0x1, &(0x7f0000000340)=[{0x0, 0x0, 0xba02000000000000}], 0x800, 0x0) 04:49:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002, 0xffffffffffffffff}, 0x1c) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x2}, 0x1c) splice(r3, 0x0, r2, 0x0, 0x1000000000000003, 0x0) inotify_init1(0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) r4 = shmget$private(0x0, 0x1000, 0xd, &(0x7f0000fff000/0x1000)=nil) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)) getresgid(0x0, 0x0, &(0x7f0000000240)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, 0x0, &(0x7f0000000380)) getgroups(0x1, &(0x7f00000003c0)=[0xee00]) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={0xffffffffffffffff, r2, 0x0, 0x3, &(0x7f0000000480)='lo\x00', 0xffffffffffffffff}, 0x30) shmctl$IPC_SET(r4, 0x1, &(0x7f0000000500)={{0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x5, 0x0, 0x7, 0x0, 0x0, r5, 0x1}) syz_genetlink_get_family_id$nbd(0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, 0x0) sendto$packet(r3, &(0x7f0000000340), 0xfffffffffffffd4d, 0x57, 0x0, 0x0) [ 923.337408] audit: type=1804 audit(1551847747.871:379): pid=2926 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir551565307/syzkaller.dvcAOz/121/file0" dev="sda1" ino=17570 res=1 04:49:08 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x480200, 0x0) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000100)={0x8, 0x3, 0x2, 0x6, 0xffffffff}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000140)={0x7fff, 0x64, 0x94e, 0x401, 0x5fa1cc60}) [ 923.403588] binder: 2939:2941 got reply transaction with bad transaction stack, transaction 2004 has target 2939:0 [ 923.431615] device nr0 entered promiscuous mode 04:49:08 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_mount_image$ceph(0x0, &(0x7f00000000c0)='./file0\x00', 0xff, 0x1, &(0x7f0000000480)=[{&(0x7f0000000380)="443907574c1834e84efb20e8f38d5a5d5884c04b91062e9ccdf2090e3f6ad58d2abe3aeb21c3465f3688f2bd924faae972a5146c7b8be40d6544f0144548101b1d0aee39cb869b99eee2aa3ecbcb52e87e24664b8cda691b7cb8a77cf0f66d96a564a928cf52ed5afb0478db8cf8541041ee1082f49e471674ac98458a7c1161f233982d6d6261ed214bb788a4e6cf3f61458c402e74ea1ebb0e1d294bb85c82dc9c9ea510cfe742d6e6cb7887d7fd3b7412fda7108e5aacb6a329164525083f2f79684072a79f9a3236bee422e521b483f9e24ee7a9cc8c09", 0xd9, 0x8}], 0x800000, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000004500), 0x400006e, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1d634440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(0xffffffffffffffff) shutdown(r2, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') setsockopt$inet_tcp_int(r2, 0x6, 0x1000000000000017, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000800)=0x0) r4 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000280)='/dev/capi20\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000540)={{0x9, 0x3, 0xc72, 0x0, '\x00', 0x9}, 0x0, 0x2, 0x9, r3, 0x2, 0x4, 'syz1\x00', &(0x7f0000000100)=['userppp0ppp1system\x00', '!proccgroup\x00'], 0x1f, [], [0x0, 0x3, 0xe8a4, 0x3]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x27, 0x0, &(0x7f00000002c0)="589a8264f5000c382b71948070e7a9bcc6192125189dbed211dbc098355a84c3f790d87568b91f"}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() semget$private(0x0, 0x5, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) dup(r4) [ 923.482534] net_ratelimit: 1 callbacks suppressed [ 923.482543] protocol 88fb is buggy, dev hsr_slave_0 [ 923.492590] protocol 88fb is buggy, dev hsr_slave_1 [ 923.514834] binder: 2939:2941 transaction failed 29201/-71, size 0-0 line 2816 [ 923.566760] binder_alloc: binder_alloc_mmap_handler: 2939 20001000-20004000 already mapped failed -16 04:49:08 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) fstatfs(r0, &(0x7f0000000080)=""/73) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x6000000, 0x3, 0x6000000, 0x3}, 0x18f) setsockopt$packet_int(r0, 0x107, 0x9, 0x0, 0x0) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 923.631654] binder_alloc: 2939: binder_alloc_buf, no vma [ 923.669057] binder: BINDER_SET_CONTEXT_MGR already set [ 923.674696] binder: 2939:2955 transaction failed 29189/-3, size 0-0 line 3035 [ 923.682619] binder: 2939:2941 ioctl 40046207 0 returned -16 [ 923.717320] binder: release 2939:2941 transaction 2004 out, still active [ 923.717454] binder: 2939:2941 got reply transaction with no transaction stack [ 923.725378] binder: undelivered TRANSACTION_COMPLETE 04:49:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$inet6_dccp(0xa, 0x6, 0x0) io_setup(0x6, &(0x7f00000003c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x1000000}]) [ 923.762483] binder: undelivered TRANSACTION_ERROR: 29201 [ 923.769021] binder: 2939:2941 transaction failed 29201/-71, size 0-0 line 2801 [ 923.776775] binder: send failed reply for transaction 2004, target dead [ 923.800302] binder: undelivered TRANSACTION_ERROR: 29201 04:49:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) syz_genetlink_get_family_id$tipc2(0x0) clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00', {}, 0xffffffffffffffff}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) [ 923.931781] binder: 2974:2975 got reply transaction with bad transaction stack, transaction 2009 has target 2974:0 [ 923.994017] binder_alloc: binder_alloc_mmap_handler: 2974 20001000-20004000 already mapped failed -16 [ 924.039569] binder: BINDER_SET_CONTEXT_MGR already set [ 924.060759] binder: 2974:2975 ioctl 40046207 0 returned -16 [ 924.101298] binder_alloc: 2974: binder_alloc_buf, no vma [ 924.148443] binder: send failed reply for transaction 2009 to 2974:2975 [ 924.181789] binder: undelivered TRANSACTION_COMPLETE [ 924.209415] sp0: Synchronizing with TNC 04:49:08 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:08 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000040)=""/145, 0x91}], 0x1) [ 924.321525] sp0: Synchronizing with TNC [ 924.424276] binder: 3001:3008 got reply transaction with bad transaction stack, transaction 2013 has target 3001:0 04:49:09 executing program 4: r0 = epoll_create1(0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000100)={0x2, 0x0, {0x0, 0x0, 0x0, 0x1e, 0x0, 0x64}}) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 04:49:09 executing program 1: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f00000004c0)=ANY=[]) 04:49:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000000)={0x1, 0x2, 0x9}, 0xc) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x400, 0xffffffffffffff28) read(r1, &(0x7f0000000100)=""/142, 0x8e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read$eventfd(0xffffffffffffffff, 0x0, 0x0) pipe2(0x0, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x12, 0x0, 0x10e) sendto$inet6(r0, &(0x7f0000000540)='\b', 0x1, 0x3fffffa, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) [ 924.571570] binder_alloc: binder_alloc_mmap_handler: 3001 20001000-20004000 already mapped failed -16 [ 924.602481] protocol 88fb is buggy, dev hsr_slave_0 [ 924.607644] protocol 88fb is buggy, dev hsr_slave_1 [ 924.672564] binder: BINDER_SET_CONTEXT_MGR already set [ 924.677937] binder: 3001:3008 ioctl 40046207 0 returned -16 [ 924.733819] binder_alloc: 3001: binder_alloc_buf, no vma [ 924.772980] binder: release 3001:3008 transaction 2013 out, still active [ 924.779996] binder: undelivered TRANSACTION_COMPLETE 04:49:09 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) lstat(&(0x7f0000000740)='./file0/file1\x00', &(0x7f0000000500)) 04:49:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='loginuid\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e1, 0x0) [ 924.816693] binder: send failed reply for transaction 2013, target dead [ 924.928619] device nr0 entered promiscuous mode [ 925.002685] protocol 88fb is buggy, dev hsr_slave_0 [ 925.007792] protocol 88fb is buggy, dev hsr_slave_1 [ 925.012944] protocol 88fb is buggy, dev hsr_slave_0 [ 925.018036] protocol 88fb is buggy, dev hsr_slave_1 [ 925.023318] protocol 88fb is buggy, dev hsr_slave_0 [ 925.028390] protocol 88fb is buggy, dev hsr_slave_1 04:49:11 executing program 2: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000100), 0x4) r0 = getpid() sched_setscheduler(r0, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x100) openat$ppp(0xffffffffffffff9c, &(0x7f0000006240)='/dev/ppp\x00', 0x0, 0x0) sched_setscheduler(r0, 0x3, &(0x7f0000000440)=0x9) prctl$PR_CAPBSET_READ(0x17, 0x1f) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f0000000280)) timer_create(0x0, &(0x7f0000000080)={0x0, 0x6, 0x5, @tid=r0}, &(0x7f00000000c0)=0x0) getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x5, &(0x7f00000003c0), &(0x7f0000000400)=0x4) timer_getoverrun(r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000180)) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000001c0)=0x3) syz_extract_tcp_res$synack(&(0x7f0000000240), 0x1, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x40) ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, &(0x7f0000000100)=0x80000000) ioctl$KDGKBSENT(0xffffffffffffffff, 0x4b48, 0x0) syz_open_pts(r2, 0x0) sched_setscheduler(r0, 0x6, &(0x7f00000002c0)=0xb1d) write(r2, &(0x7f0000c34fff), 0xffffff0b) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r3, 0x40045542, &(0x7f0000000200)=0x80000000) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000140)={0x5, 0x5, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x9}) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f00000004c0)=""/4096) ioctl$VIDIOC_QUERYCAP(r4, 0x80685600, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000005, 0x5c831, 0xffffffffffffffff, 0x0) 04:49:11 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(0xffffffffffffffff, 0x0, 0x0) r2 = gettid() ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) r3 = dup2(r0, r1) shmctl$SHM_INFO(0x0, 0xe, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) write$P9_RLCREATE(0xffffffffffffffff, 0x0, 0x1d6caed95f5f079) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) timer_create(0x0, 0x0, 0x0) write$P9_RREADDIR(r3, 0x0, 0x0) tkill(r2, 0x1000000000016) 04:49:11 executing program 1: clone(0x200, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f0000000400)='./file1\x00', &(0x7f0000000440)='./file1\x00') mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000300)='./file1\x00', 0x0, 0x0) ioctl$TIOCSCTTY(r2, 0x540e, 0x0) 04:49:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:11 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') renameat2(r0, &(0x7f0000000080)='./file0\x00', r0, &(0x7f00000000c0)='./file0\x00', 0x0) 04:49:11 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 927.080719] binder: 3053:3060 got reply transaction with bad transaction stack, transaction 2017 has target 3053:0 [ 927.119849] binder_transaction: 4 callbacks suppressed 04:49:11 executing program 5: perf_event_open(&(0x7f0000000080)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x400, 0x0, 0x0, 0x0, 0x8, 0x93, 0xb09, 0xc9f4, 0x0, 0x8, 0x4f, 0x3, 0x6, 0x81, 0x8, 0xf, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffc00, 0xffffffffffffffc1, 0x10000, 0x5, 0x6, 0x0, 0x0, 0x5, @perf_bp={0x0}, 0x1, 0x0, 0x6, 0x7, 0xf09e, 0x9, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0xa02, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) fcntl$notify(r0, 0x402, 0x20) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x0, 0x3, @thr={&(0x7f0000000040), 0x0}}, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = socket$inet6(0xa, 0x40000080806, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000100)) bind$inet6(r2, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r2, 0x20000000) r3 = socket$inet6(0xa, 0x6, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000180)={0x7, 0x0, 0xee4, 0x0, 0x19, 0x5, 0x2, 0x6, 0x0, 0x0, 0x1ff, 0x12c}) connect$inet6(r3, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = accept4(r2, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0) setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000040)=0x100000000001f, 0x87) sendmmsg(r4, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) 04:49:11 executing program 4: clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000300)=@broute={'broute\x00', 0x20, 0x2, 0x230, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200004c0], 0x0, 0x0, &(0x7f00000004c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x8100, 'nr0\x00', 'team0\x00', 'vlan0\x00', 'veth0_to_team\x00', @remote, [], @remote, [], 0xd0, 0xd0, 0x100, [@vlan={'vlan\x00', 0x8, {{0x0, 0x0, 0x892f, 0x7}}}, @connlabel={'connlabel\x00', 0x8}]}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0xb, 0x0, 0x0, 'bond0\x00', 'team0\x00', 'bond0\x00', 'veth1_to_bridge\x00', @remote, [], @broadcast, [], 0x70, 0x70, 0xa0}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}}]}]}, 0x2a8) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, 0x0, 0x0) [ 927.119869] binder: 3053:3060 transaction failed 29201/-71, size 0-0 line 2816 [ 927.160515] binder_alloc: binder_alloc_mmap_handler: 3053 20001000-20004000 already mapped failed -16 [ 927.184843] binder: BINDER_SET_CONTEXT_MGR already set [ 927.191703] binder_alloc: 3053: binder_alloc_buf, no vma [ 927.220839] binder: 3053:3060 ioctl 40046207 0 returned -16 [ 927.243304] binder: release 3053:3060 transaction 2017 out, still active [ 927.252939] binder: 3053:3070 transaction failed 29189/-3, size 0-0 line 3035 [ 927.262478] binder: undelivered TRANSACTION_COMPLETE [ 927.280635] binder_release_work: 6 callbacks suppressed [ 927.280642] binder: undelivered TRANSACTION_ERROR: 29201 [ 927.312750] cannot load conntrack support for proto=7 [ 927.327531] binder: undelivered TRANSACTION_ERROR: 29189 04:49:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 927.355770] device nr0 entered promiscuous mode [ 927.374359] binder: send failed reply for transaction 2017, target dead [ 927.391023] cannot load conntrack support for proto=7 04:49:12 executing program 4: socket$unix(0x1, 0x0, 0x0) write$P9_RLINK(0xffffffffffffffff, 0x0, 0xbbb8820c) r0 = socket$unix(0x1, 0x1, 0x0) pwritev(0xffffffffffffffff, 0x0, 0xfffffffffffffc98, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000000), 0x4) [ 927.598738] binder: 3099:3102 got reply transaction with bad transaction stack, transaction 2021 has target 3099:0 [ 927.683091] binder: 3099:3102 transaction failed 29201/-71, size 0-0 line 2816 [ 927.747425] binder_alloc: binder_alloc_mmap_handler: 3099 20001000-20004000 already mapped failed -16 04:49:12 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000180)='./file0/file0\x00', 0x2000, 0x40) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@dev}}, &(0x7f0000000380)=0xe8) r2 = getgid() write$FUSE_ATTR(r0, &(0x7f00000003c0)={0xfffffffffffffed0, 0x0, 0x7, {0x0, 0x6c6, 0x0, {0x5, 0x0, 0x7, 0xcff, 0x0, 0x3, 0x3, 0x0, 0x0, 0x1, 0x3, r1, r2, 0x2, 0x7}}}, 0x78) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000008c0)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) lsetxattr$security_evm(0x0, 0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffd82, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x10, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x19}}, 0x1c) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) symlink(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000700)='./file0/file0\x00') syz_genetlink_get_family_id$tipc(&(0x7f00000004c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r0, 0x0, 0x800) umount2(0x0, 0x0) chown(0x0, 0x0, 0x0) chdir(&(0x7f0000000340)='./file0\x00') setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) openat(0xffffffffffffffff, &(0x7f0000000640)='./file0/file0/../file0\x00', 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f00000008c0), 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000680)) getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, &(0x7f0000000780)) 04:49:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) syz_execute_func(&(0x7f0000000100)="3666440f50f564ff0941c3c402fd176f9c66420fe2e32e46da5a40f081182f2d8b33d319ae") clone(0x6102001dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000003d40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 927.792555] binder: BINDER_SET_CONTEXT_MGR already set [ 927.851906] binder: 3099:3102 ioctl 40046207 0 returned -16 [ 927.945685] binder_alloc: 3099: binder_alloc_buf, no vma [ 928.002703] binder: 3099:3102 got reply transaction with no transaction stack [ 928.053824] binder: release 3099:3102 transaction 2021 out, still active [ 928.061135] binder: 3099:3121 transaction failed 29189/-3, size 0-0 line 3035 [ 928.092794] binder: 3099:3102 transaction failed 29201/-71, size 0-0 line 2801 [ 928.104834] binder: undelivered TRANSACTION_COMPLETE [ 928.152596] binder: undelivered TRANSACTION_ERROR: 29201 [ 928.178534] binder: undelivered TRANSACTION_ERROR: 29201 [ 928.199676] binder: undelivered TRANSACTION_ERROR: 29189 [ 928.223657] binder: send failed reply for transaction 2021, target dead 04:49:12 executing program 2: 04:49:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r1 = dup(r0) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r2, 0x80080) sendfile(r1, r2, 0x0, 0x2008000fffffffd) 04:49:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:12 executing program 5: r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r0, 0x0, 0x0) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="34000000dfe2340000005a008000"], 0xe) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f0000000200)='./file0\x00', 0x8, 0x1) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x10000000000, @local}, 0x10) connect$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, &(0x7f0000001080)) sched_setaffinity(0x0, 0xffffffffffffffbc, &(0x7f0000000500)=0x6) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000240)={0x0, 'veth0\x00', 0x2}, 0x18) 04:49:13 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) [ 928.445615] binder: 3146:3149 got reply transaction with bad transaction stack, transaction 2026 has target 3146:0 [ 928.479451] binder: 3146:3149 transaction failed 29201/-71, size 0-0 line 2816 04:49:13 executing program 2: [ 928.549062] binder_alloc: binder_alloc_mmap_handler: 3146 20001000-20004000 already mapped failed -16 [ 928.594534] binder: BINDER_SET_CONTEXT_MGR already set 04:49:13 executing program 1: 04:49:13 executing program 2: [ 928.625769] binder: 3146:3149 ioctl 40046207 0 returned -16 [ 928.655354] binder_alloc: 3146: binder_alloc_buf, no vma [ 928.668630] IPVS: ftp: loaded support on port[0] = 21 [ 928.701743] binder: send failed reply for transaction 2026 to 3146:3149 [ 928.714033] binder: undelivered TRANSACTION_COMPLETE [ 928.722092] binder: 3146:3163 transaction failed 29189/-3, size 0-0 line 3035 [ 928.747766] binder: undelivered TRANSACTION_ERROR: 29201 [ 928.765012] device nr0 entered promiscuous mode [ 928.777066] binder: undelivered TRANSACTION_ERROR: 29189 04:49:13 executing program 1: 04:49:13 executing program 2: 04:49:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 928.819788] binder: undelivered TRANSACTION_ERROR: 29189 [ 928.954575] binder: 3217:3231 got reply transaction with bad transaction stack, transaction 2030 has target 3217:0 [ 928.994594] binder: 3217:3231 transaction failed 29201/-71, size 0-0 line 2816 [ 929.032115] binder_alloc: binder_alloc_mmap_handler: 3217 20001000-20004000 already mapped failed -16 [ 929.074926] binder_alloc: 3217: binder_alloc_buf, no vma [ 929.089364] binder: BINDER_SET_CONTEXT_MGR already set [ 929.103595] binder: 3217:3231 ioctl 40046207 0 returned -16 [ 929.117186] binder: 3217:3308 transaction failed 29189/-3, size 0-0 line 3035 [ 929.175689] binder: undelivered TRANSACTION_ERROR: 29189 [ 929.181313] binder: send failed reply for transaction 2030 to 3217:3231 [ 929.201709] binder: undelivered TRANSACTION_COMPLETE [ 929.207005] binder: undelivered TRANSACTION_ERROR: 29201 [ 929.317286] IPVS: ftp: loaded support on port[0] = 21 04:49:15 executing program 4: 04:49:15 executing program 2: 04:49:15 executing program 1: 04:49:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:15 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:15 executing program 5: 04:49:15 executing program 5: 04:49:15 executing program 2: [ 931.311315] binder: 3316:3328 got reply transaction with bad transaction stack, transaction 2034 has target 3316:0 04:49:15 executing program 1: 04:49:15 executing program 4: [ 931.372116] binder: 3316:3328 transaction failed 29201/-71, size 0-0 line 2816 [ 931.389350] binder_alloc: binder_alloc_mmap_handler: 3316 20001000-20004000 already mapped failed -16 04:49:16 executing program 5: [ 931.458225] binder: BINDER_SET_CONTEXT_MGR already set [ 931.482088] binder: 3316:3328 ioctl 40046207 0 returned -16 04:49:16 executing program 2: 04:49:16 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0xfffffffffffffffd, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) readv(r1, &(0x7f0000000600)=[{0x0}], 0x1) 04:49:16 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockname(r0, &(0x7f0000000580)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f00000001c0)=0x80) setsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, 0x0, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x400, &(0x7f0000000040)=0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000740)={0x0, 0x3, 0x30}, &(0x7f0000000780)=0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'sit0\x00\x00\x02\x00'}) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) listen(r2, 0x5) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000640)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000000140)=0xe8) accept4$unix(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x80800) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, &(0x7f0000000540)) socket$rxrpc(0x21, 0x2, 0x10002) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000380)=""/146, 0x92, 0x2000, &(0x7f0000000440)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000200)={@dev={0xfe, 0x80, [], 0xa}, 0x26, r3}) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000004c0)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) socket$inet6(0xa, 0x5, 0x2) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000000c0), &(0x7f0000000500)=0x4) [ 931.531498] binder_alloc: 3316: binder_alloc_buf, no vma [ 931.554159] binder: release 3316:3328 transaction 2034 out, still active [ 931.567700] binder: undelivered TRANSACTION_COMPLETE 04:49:16 executing program 5: syz_emit_ethernet(0xfed1, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x4788, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) [ 931.586715] device nr0 entered promiscuous mode [ 931.604387] binder: send failed reply for transaction 2034, target dead 04:49:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 931.763284] binder: 3350:3351 got reply transaction with bad transaction stack, transaction 2038 has target 3350:0 [ 931.777188] binder_alloc: binder_alloc_mmap_handler: 3350 20001000-20004000 already mapped failed -16 [ 931.793394] binder_alloc: 3350: binder_alloc_buf, no vma [ 931.793956] binder: BINDER_SET_CONTEXT_MGR already set [ 931.806436] binder: 3350:3351 ioctl 40046207 0 returned -16 [ 931.818978] binder: release 3350:3351 transaction 2038 out, still active [ 931.847954] binder: undelivered TRANSACTION_COMPLETE [ 931.861525] binder: send failed reply for transaction 2038, target dead [ 932.034763] device sit0 entered promiscuous mode 04:49:16 executing program 5: r0 = memfd_create(&(0x7f0000000140)='lotrusted\x1a\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) 04:49:16 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2a) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="6332e709d7be923523d9c4390040d5d497dc2a57d1fe6ec1c9814ad868c1efc20ab57b42ab2834720000a54073731d8cd0d509f969efd70d6a"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) 04:49:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:16 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0xf}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x200000007) write$cgroup_int(r2, &(0x7f0000000000)=0x1, 0xfdef) 04:49:16 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x5, 0x100) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) memfd_create(&(0x7f0000000000)='aegis128-generic\x00', 0x5) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) close(r2) close(r3) [ 932.122419] device sit0 left promiscuous mode [ 932.222673] binder: 3364:3366 got reply transaction with bad transaction stack, transaction 2042 has target 3364:0 [ 932.267825] binder_transaction: 3 callbacks suppressed [ 932.267851] binder: 3364:3366 transaction failed 29201/-71, size 0-0 line 2816 [ 932.308873] binder_alloc: binder_alloc_mmap_handler: 3364 20001000-20004000 already mapped failed -16 [ 932.332707] binder: BINDER_SET_CONTEXT_MGR already set [ 932.345140] binder: 3364:3366 ioctl 40046207 0 returned -16 [ 932.360357] binder_alloc: 3364: binder_alloc_buf, no vma [ 932.373047] binder: 3364:3378 transaction failed 29189/-3, size 0-0 line 3035 [ 932.391444] binder: 3364:3366 got reply transaction with no transaction stack [ 932.408659] binder: 3364:3366 transaction failed 29201/-71, size 0-0 line 2801 04:49:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:17 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r1 = dup(r0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000000c0)={r2, 0x5, 0x7, 0xffffffffffffffff, 0xe000000000000000, 0x4}, &(0x7f0000000140)=0x14) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbff, 0x1804200}, 0xc) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) [ 932.518027] device sit0 entered promiscuous mode [ 932.529284] binder: BINDER_SET_CONTEXT_MGR already set [ 932.542594] binder: 3385:3387 ioctl 40046207 0 returned -16 [ 932.573945] binder_alloc: 3364: binder_alloc_buf, no vma [ 932.598980] binder: 3385:3387 transaction failed 29189/-3, size 0-0 line 3035 04:49:17 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x0, 0x0) ioctl$TIOCLINUX6(r1, 0x541c, &(0x7f0000000300)={0x6, 0x7ff}) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000040)) r2 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f0000000280)={0x0, 0x1, 0x80000000}) ioctl$KVM_PPC_ALLOCATE_HTAB(r3, 0xc004aea7, &(0x7f0000000140)=0x80000000) ioctl$VIDIOC_TRY_DECODER_CMD(r2, 0xc0485661, &(0x7f0000000340)={0x1, 0x1, @raw_data=[0x6, 0x101, 0x10001, 0x8, 0x7f, 0x5, 0x6, 0xff, 0xfffffffffffff622, 0x2, 0x7, 0x75ab9579, 0x8, 0x7f, 0x9, 0x7]}) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000180)={0xc, @output={0x1000, 0x1, {0x800, 0x1}, 0xc5, 0xfff}}) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f00000000c0)=0x3ff) [ 932.640557] binder: 3385:3389 got reply transaction with no transaction stack 04:49:17 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-sse2\x00'}, 0xffffffffffffff6f) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r1, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000000580), 0x1, 0x0, 0xffffffffffffff15}, 0xffffffffffffffff}], 0x1, 0x40000000, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000140)={0x8, &(0x7f0000000100)=[{0x10000, 0x3f, 0x2, 0x4000000080000000}, {0x0, 0x3ff, 0x1, 0x8}, {0xfffffffffffffffa, 0x3, 0x9d2, 0x7}, {0x100, 0x4, 0xff, 0xf4b}, {0x5, 0x0, 0x3f, 0x4}, {0xc1e, 0x5, 0xfd5, 0x2}, {0xde0, 0x171, 0x1, 0x3}, {0xf6, 0x7, 0x8000, 0x5}]}) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f00000000c0)=""/35) [ 932.681790] binder: 3385:3389 transaction failed 29201/-71, size 0-0 line 2801 04:49:17 executing program 2: mount(0x0, 0x0, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x101000, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(0xffffffffffffffff, 0xc0106403, &(0x7f0000000240)={0x0, 0x5}) mkdir(&(0x7f0000000000)='./control\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x9, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000140)='syzkaller\x00', 0x6f1a, 0xfb, &(0x7f00000003c0)=""/251, 0x0, 0xfffffffffffffffe, [], 0x0, 0xd}, 0x48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r1, r0, 0xd}, 0x10) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) socket$inet(0x2, 0x0, 0x0) execve(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) [ 932.747406] binder_alloc: binder_alloc_mmap_handler: 3385 20001000-20004000 already mapped failed -16 04:49:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) io_setup(0x101, &(0x7f00000000c0)=0x0) r2 = socket(0x1e, 0x1000000000005, 0x0) sendmsg(r2, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=@generic={0x10000001001e, "030000000000000000000001e526cc573c5bf86c483724c71e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xfff, 0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x3, 0x80000001, r0, &(0x7f0000000640)="195febe5475abd4733afbbdc1155f34f3faab186fb8526f90f62bd85769465015592f792a1d66580180a068750913efb9190092b0412c41894b47fd1ab72d673b2adcf56b6c85cfd00a1a61504bd3539be8473adc0ae9a37704f654309b678c11da5c152162feca8f68b9f4aa745f60a90458bb74bad7d379fa6bce7e7f2742be5dfae3837194301ae862d123972b242da68a9d3934fea36da9f32ecd33ed3a71cd047e9d63b5b822b35b9fc0a8ae18581f395a5174cae659852386c4e0cd41c2ec138ffd15949f863911f9d981323b97b566988f2dc35c01449c59d7423e66e7bd593095f61ba7df7fa57e3a831de81cb1e7415c99a0729c13dd16c3be85c4968af7cdb6e5837bdd2e8061ddcae1451625edc05569782e235f3428b53dba50e0bad6eb90005de0817dceef25c1b45cde97ac7bc459d245f6de1d896058b3ecaa5d7a442345609ea5ec646d693ad9b96457534e04683ab672ac14649f5b629fa11c1fd688ef28c8041457152eca0b603df646c97215a4a8ae73ac738d290aa3a076ee490436a5fe62715709be39be0ebd9e5fe07da93b795038a6866ec08ed60e4fd813cde4ce953805f3710912d90197c7c0052440c4c1d4ff24bc37449ae475dd0fa359b1f3f2033d54202035cbcee900a61ddac6da321ba5815ddcd60a3d6d46718344e8decf356d3ad4034f0ef6aeb5b5d0a7a71e7df212cab48e4e915177f6138f54abd1d21df1ee3261d60610b7eaab7008a5f7189ef1367d29619f11f0a95267ea21681be3a29b841c9683506ef5d3a7f02c00567ad8001d413bb712c89f2491839655f1a6a8c2f04f7b4ace9dd160ed5310691a81482b39dcf6043b5f6315b7c3a04cbdf16e69d589fe80668a4c348f8edb5eb9be2ffcae8e652a10c96d6f60e6e86db6295eec217c9108b3cca1199e9a30782f39aa7e71c0db90e9299a83cb4d03791b837a9a06c242242abe458ab42eb78835aa3e6a341c609eeaebf3dce178230b543a8ef3cf3096a543e8de98746e31957dfc6efbd2af47887a2ce3f4298f7f06e52a7e76a4e5080a37e3e7d3aab8439c4c79388c0817f07970b3b33453446d6f41315da28b5d3c56e970b14074f41f823b674178b3132f27d8fcdb7a98859d458d51b0fb0ffe6bad26c75731e185ad7d69608ffc62c65b0d7b1db82669ae1bd3efd620463aa05f23c3d4afd0713b2408e21583bf86aed54fe14995af27c2e69c464901ba0904be4b2a613d236b213bce700d25971f13444f71116137d49feccbd0377d1f227042b1f8b865d923cac92e648436e85c8a308db30136f54ce40adf1e0b9e17e7ac9a9505408cd8882387b9ebc797df395234d1c546de2c13a3577f8c59f143890e27c0dcd132bd5ef72ccbb9d7e6f270f83b3a55bac727acbb142ff7ff5378ba0c5d4636187cc471d2bae8671dd0f4e57573de1887cc0ba18f76e8d4527cb9951ae102113873b85894193f34306619e9dff810dcc67064aa36e8118568bb7198e8defe00e992e9556f6fdf5122d30ec7e608990a6d48da76ca547cb2d6ab540fa1c541ac20d398de10cc99d60290e4d48931a09bc9e82f351d0d0626e403b6116cb4e5f7dbe505a7cdca0f2b378f8ed36aa3c04bc3c3a51d9c8947b21298a9b3b5a694be66e50937f0a03346a8379a505e27557a87dd075cca10cad50d473727c7c4ff1b847224585d4d15506636d7f4ddb0d5f46856349c386035ab5a217d6927e29b5c118b6daafef2012dbc469fd1ee28489a3a4093a43764d2f508b4187f1200ef06f6d465c1dd233369a26dc539859d366fd0ac3811754bd66bd1b7d7c72799ae9c6e02703a5907bc8302bca0c5f5a9dbee051565308baf6d79b334354a70754bf9ab6ef4c2dbcc560df4548e10e061491ae4ddcc78c4665509dfa987f3cfe0307cf240f392ca6690e5eb62a37c002b35f56f6526ed3b700dcb23a51c4200d01b115d0a5d2354af386d685cb6d940849dd2c3468d9b45034750dc228f8d4f07ca97a305a52acb09f2b8321f0b700eb311b2769d5eb743d4900976fe723aaf71fb2a1a585e3280c2f2d068ccdde5fd17b648a13399e73ef9936e62104fecb328db37218bc155d806d042d0f13080ad7763bcbd495ffd97bac248aacb6910149010f10013746e6d65d9572be11092af9fb3f03dfc1149ccac414f07ca4561d42a9276fcb9345b993f379e03b0e139fc096ef56a8a262381d89406744635aefdc686bd10c2746c5d47594550b5a52d75badb06c0d30bafd70bb455516d1e9a6e26976197b94f9f23bcdd72dac48efd77adf8b8490de27319a33af36294f7ce5d024c7e7927cdcaf67ab44e213d8eec4a11bce181b1b4940b66249128d9f59fa84e957775bc9bfcfb24546a33eafa7585d81237e08d8c7f7f37ccc953961ebd35406f42860f6b7f83ddaa92aa6bc2fb6c501db512498d7b3f96f9d6e41eee3a9ae30f823db6db67b14e24daedf0f3ba808374aefac6a95def2fc8f2eb8aa4e6274225daa1c681509ddb017a80351bc7476a1a98de07703e7f284ae69e6318e867aeab486252447e96e20ca785efbf2312ba1efacd21556ccbdeda91cf811a191c97658080c825151592f6405d141813d73660b0fdb466abc1204c62096934b72e54b1d1db3694e8c31a6556b316a6a4279496780dcfcac4eb0a28af2ab29bb687263a56cab9384b8ac6264da0036afd7838e04193ee58496a63e4677256780f61861b684086848050617428f5a6ead5f0f1598a5532256063502e3403bbdeca55c6551488d41046e6102db82c07021ee87b45cea7acfca6ff81a8ce47b6add3db87716acf7f6ce21a67f45233aae82ecf28c5d2d8bb52206af89f010d7d7e32c25b2b17a4aff16467d1d80b01f6faa3a948f49c67f08dc5253de48868f27fcb49329434f12c39f1017208a3a36c4915f01de75c7c0c4983783a407eb7c5cc625bfde140869e872d73ac11bb82f001c780705422d9d0c5ccdfd7dba10bc6243cb3e82760c46212c411aa87785319fbe456d244ffcdfc80619514697d2108888aceca1b8321322b53f422982c601bec97cff61ba4d0e0ecba141edc9a83d5b258b3fee60114084ab590c3a9352d2783fdba3c8cec3b5c265b8c04b6d5960441590c9852f13394d1591d30c308f892a956685e7e9e227b5729ea1103805d13c56f1124f9bee67567f311a3dfda0bd6a2f7e58879032c740378484ef91d3c393a906d64a03b9f74b85d44cf52c2ec07e2f41ad4930b95311f70ac249b2b9110a42ff4188b7aabd37001a2cfc08ee42bfdec2b56f7b67e7ea77997fb58ecb281a6e3f90fa0251357740ac19d153e6fbb704cf5c0acec173fec664d3c9f0d3637e63909b64af5f95b216397d1425be6278d6ba6ce71056844a091fc5c8115db7bf25383022ab742026b1743a1bbff5cd02bab34ddc4e8b4869ef732deb457bd7a25093f25769c7d05f5f24d1a6f39aeabe9998f14afe3c57ab41bd5dd35a2ae51eea2426c0e5812d044f975f16b79fc3ca868fd931060b10e69cc5335efedbb9459307ca2b549575ab6d1f0006eb393b8013da801768dad4ebed257061b522083d6047e00e0b989a10453e9cc67eec4271f3b91c6eef57dc4d51bad72f3668ecac248ca6ff91befa577f590c9dcc732a32f9cab39d73317988a6f934b9e0835920fd9739cc1c735eb50b1d18c5d8c87aab0760ccee278e06577def360ae12abddee32a810e8418c08944448153790f420db9f81fe52b2f6772056917c59bb5e65e2d6ae4af36221a245a203f50024821481f2717a5ea6c39b85d351941073b519428799162e5b774ba40293548a4757bf41b5898358407d32c2d5da28cb7affd2d89d71b6857455d84ed5b65d4588ccaa363584975bdc549331da0def6e8c7274b7673309264192ec625deefb624009a82c29269847963a3414daf0dcaae2895610c52c8e128a95e7f45fa6004b3889b4718040faed2c05a00c806890920df305801bd3f4b8229a4f1df25c607bfc0928113aa7390e1b8736df5216a45a29eaf81240b1a4f8cdb88f8b9c037315a9ded889e561ec9ffe3b3953a900daa999c5c24b1ddabcfa81fd98b2ccae56338a1a8ed1f9173b2c7d72ab793078e340d8a1a850dfa81d78fe867678c31651fb4de75c420e2d95f171e0c91bdd9d5cd1b2b638f88af2119f61fe3796577066c2702f356638483602358b63a1f13f2251c07f4df84b6bd489419baea66aa71c74a1928d3e7f6bf2bbedb8f66a3b32377320f4bf0dc937af5eadeebfba858bb9decb6cae1fec44f7e1eac831d3953ca3531fca3eb15b4e9d34b4ac302651e56006599e72efafe9dc71d80559f3ca3cdbb2e99a6856c3fc5f530ffc5a998281c41a8e3a9b7e7dbee4557930f40b71383c5e378052588ddd5c8265763e18cf627557fde1fc35ba523822960c7761e2a21ec5462da4ecf7f652a6199f3f9d3d6578c96db0d50ddce4c9a27846c2a4503fa1ccb254ecd79c6910470c22fa910a0a45aa738bd1350c198f40909700d60c1eb46a30dfe725c5aaff5d275d418afd59fae9696d66af0549e49a7fc7761699b81e897e5e0d780e5920879e4e1fa7fa0676b345f15add7a49be878fb8bbf537d700d7d3078553ecba6f64ed9ffea87e20326c053586a17f339646124974931c299c3d83d4af25a902735359266c3466e9c6fabadf0be43aeea6eda1f76f05f07aa0daf62c771061566f50c7b0442faa2782647f93d0adeb5b582ba7a33e349761f0508cf2f202a176d535e8559351fa7caa7c57efbc7b8f1624e2bc998b19199c0d67d143f2c1624864c2c88df0c707e2ed575efaaf353df2e37ebbc9abcff5ddf776bc7330e0d1d19cfc4cb764c4f0b0ab9dc5ea66177ed5673bce32f24ca7be546f957bae21f6a1124d092022ace97f345e391959dc97a23aed9860b0fa9bc7f384af2ba88489b2446688188a32c4efeba8a40d30069f3975ae0a39c75010dd574f64ee423a7587b2bd1df6218f1b99d24ebf2f59938182bbd155b6bbdc45db01f5223e3e01a390d3084459efcc1382fc1c5cc93ae76def14a8debcc85d73893b8769f8c747501f67e87940add9ad1cff526d836af67c54125d19be2a8f51e1aaa3693e9199e59aa9f61a676dc3b05130bbbd2b12ee47a958bffe1a39289e9dcfba46969107ca2c4ae98eeccfecfe79a25706443392ab3eba3cc82281cb03e395d6e1c75163318d45f37b06532e51c9e885b147e1ae9fc627162d30c2d5fd3d1ee32e2842f3f4cb57cca20c5bc1bf1d06524181a158742ed3b8597082054ef8447a8bedf641c2ea48548cd7fdee5004916135842985694364bcad5accda6266bc9dfd80d4dc6fbf7071c0f4cad15a6687dacb36235e4404d843442ecc3d9dd004031e96551f3e80efe33e9741a92630b46b5288ed335b882b52cfba707974220c6a7a6a4139309e66b2f6fe64b263fa4c8178c4c641911ea6e7a13545d5a0bde4d269e2e747b0dbb90ffd186698af945dafe8efd010dd7be0cc4f8f0a79fd5c8ec4905c40cbf0bafcb1d66a5e901255988a99428adbf66109fce0fde2c067af44a8837d5494f91a9f81fd1c423bf28648156ac2653cbe89b8fd96a93afa90421a7588a34a932574fc1f7bb092bd5297b976c2eaa3c21a29be14663d15656dbc84d7a6445313a0e8e19c365a3799f83c4f93752b232434b659041e3897e3cc578b4dd476650b57063fa174021fbd9b1e04727863a843a1c6eb4eb4c341728fbed61d46696819ff5641d16376dba5bcc22e3d1c7862ecc1797e7843e", 0x1000, 0x5, 0x0, 0x2, r3}]) [ 932.813049] binder_alloc: 3364: binder_alloc_buf, no vma [ 932.815092] device nr0 entered promiscuous mode [ 932.842511] binder: BINDER_SET_CONTEXT_MGR already set [ 932.847836] binder: 3385:3387 ioctl 40046207 0 returned -16 04:49:17 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000300)="0700000000749a0df7001400689a00080088b07023911dfd7bfe8f2fa6215df9c774cec43c428b96141c25938eceb30b8720a17d78177e344b81c101dd51b63d0bc1c610cca1072a775e522f946dc4e77e1c7069249a073308f977876eaa85d67b6a3089897d6f179d08026a215d1ec751e585d632af5b09e16a9a9fb68ede594ef0565d666c517f0a83333d8c6cfdfc18ce9a7153755a7eadd977edbbac05f9feb9f90ed222c6eec9adf77c2e0985990c788d190c1eaecf9b6583877d095fa6be8c31f1694a66070f0dc168cf40310110a5c71b6e0f5d2ab98740d066b963c6f9fc4b891918b495a4b9d8195f2234e331bd8aedb94dc8570697d02f70acc58ef05536c34d96a5be11271a934e3ba531bddc9154d0a9ddc56dde8dc66224907f55c798c615d9b89835532e981c7653dba96510ad613add28") mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4002011, r3, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) futex(&(0x7f0000000000)=0x2, 0x8b, 0x1, &(0x7f00000000c0)={r4, r5+10000000}, &(0x7f0000000140)=0x1, 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mISDNtimer\x00', 0x2, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r6, 0xc008ae88, &(0x7f0000000580)={0x7b, 0x0, [0x10a]}) [ 932.886001] binder: 3385:3389 transaction failed 29189/-3, size 0-0 line 3035 [ 933.012608] INFO: task syz-executor.1:27559 blocked for more than 140 seconds. [ 933.037978] Not tainted 5.0.0+ #7 [ 933.060162] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 933.076028] kobject: 'kvm' (00000000e4af41d9): kobject_uevent_env [ 933.098470] syz-executor.1 D28512 27559 23779 0x80000006 [ 933.111972] kobject: 'kvm' (00000000e4af41d9): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 933.119492] Call Trace: [ 933.130775] __schedule+0x817/0x1cc0 [ 933.139315] ? kasan_check_read+0x11/0x20 [ 933.149782] ? pci_mmcfg_check_reserved+0x170/0x170 [ 933.163030] ? __switch_to_asm+0x34/0x70 [ 933.173881] ? __switch_to_asm+0x40/0x70 [ 933.185185] schedule+0x92/0x180 [ 933.194903] schedule_timeout+0x8ca/0xfd0 [ 933.206122] ? pci_mmcfg_check_reserved+0x170/0x170 [ 933.218441] ? usleep_range+0x170/0x170 [ 933.227240] ? preempt_schedule+0x4b/0x60 [ 933.238541] ? preempt_schedule_common+0x4f/0xe0 [ 933.252743] ? preempt_schedule+0x4b/0x60 [ 933.261751] ? ___preempt_schedule+0x16/0x18 04:49:17 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000017000)=0xfffff7fffffffffd, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0xcd, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x24e20, @multicast2}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RREADDIR(r3, &(0x7f0000000280)={0x11c, 0x29, 0x2, {0x401, [{{0x50, 0x0, 0x3}, 0x3, 0xc3b, 0x7, './file0'}, {{0x10, 0x0, 0x3}, 0x7ff, 0x6, 0x7, './file0'}, {{0x41, 0x1, 0x4}, 0x10000, 0x2, 0x7, './file0'}, {{0x0, 0x0, 0x1}, 0x0, 0x8000, 0x7, './file0'}, {{0x1, 0x1, 0x5}, 0x100000000, 0x3ff, 0x1, '.'}, {{0x1}, 0x80000001, 0x6, 0x7, './file0'}, {{0x10, 0x2, 0x2}, 0x2, 0x1, 0x7, './file0'}, {{0x48, 0x4, 0x5}, 0xe41, 0xf0f3, 0x7, './file0'}, {{0x40, 0x0, 0x6}, 0x6, 0x80000000, 0x7, './file0'}]}}, 0x11c) listen(r3, 0x9) pipe2(&(0x7f00000000c0), 0x4800) 04:49:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 04:49:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000380)='./file0\x00', 0x6c400, 0x0) write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x10000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x10) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000200)) r2 = getpgrp(0x0) waitid(0x20000000000002, r2, 0x0, 0xa, &(0x7f0000000240)) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)=""/1, &(0x7f0000000100)) [ 933.273262] wait_for_completion+0x29c/0x440 [ 933.283502] ? wait_for_completion_interruptible+0x4b0/0x4b0 [ 933.291365] binder_release_work: 5 callbacks suppressed [ 933.291373] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.303101] ? wake_up_q+0x100/0x100 [ 933.307310] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.313478] ? mark_held_locks+0xb1/0x100 [ 933.337605] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.344229] ? kfree+0x173/0x230 [ 933.348565] ? tls_sk_proto_close+0x63c/0x7a0 [ 933.355044] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.362390] tls_sw_free_resources_tx+0x3c2/0xa30 [ 933.368208] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.374411] tls_sk_proto_close+0x644/0x7a0 [ 933.383099] binder: send failed reply for transaction 2042 to 3364:3366 [ 933.392600] ? debug_object_activate+0x2c8/0x4f0 [ 933.397544] audit: type=1800 audit(1551847757.931:380): pid=3423 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17609 res=0 [ 933.418249] binder: 3419:3421 got reply transaction with bad transaction stack, transaction 2050 has target 3419:0 [ 933.420704] ? tcp_check_oom+0x560/0x560 [ 933.433645] binder: undelivered TRANSACTION_COMPLETE [ 933.444419] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.453055] audit: type=1804 audit(1551847757.931:381): pid=3423 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir620796598/syzkaller.KZiDP9/680/file0" dev="sda1" ino=17609 res=1 [ 933.462378] binder: 3419:3421 transaction failed 29201/-71, size 0-0 line 2816 [ 933.478322] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.501389] ? tls_push_sg+0x6b0/0x6b0 [ 933.511575] ? ip_mc_drop_socket+0x211/0x270 [ 933.526818] ? __sock_release+0x89/0x2b0 [ 933.536866] inet_release+0x105/0x1f0 [ 933.547372] inet6_release+0x53/0x80 [ 933.560346] audit: type=1800 audit(1551847757.931:382): pid=3423 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17609 res=0 [ 933.574979] binder_alloc: binder_alloc_mmap_handler: 3419 20001000-20004000 already mapped failed -16 [ 933.580736] __sock_release+0xd3/0x2b0 [ 933.602570] binder: BINDER_SET_CONTEXT_MGR already set [ 933.614113] binder: 3419:3421 ioctl 40046207 0 returned -16 [ 933.622956] ? __sock_release+0x2b0/0x2b0 [ 933.634351] sock_close+0x1b/0x30 [ 933.645356] __fput+0x2df/0x8d0 [ 933.656065] ____fput+0x16/0x20 [ 933.665813] task_work_run+0x14a/0x1c0 [ 933.676230] do_exit+0x92c/0x2fd0 [ 933.687020] ? get_signal+0x331/0x1d50 [ 933.698571] ? mm_update_next_owner+0x660/0x660 [ 933.713076] ? kasan_check_read+0x11/0x20 [ 933.726011] ? _raw_spin_unlock_irq+0x28/0x90 [ 933.733742] binder_alloc: 3419: binder_alloc_buf, no vma [ 933.739680] ? get_signal+0x331/0x1d50 [ 933.751902] ? _raw_spin_unlock_irq+0x28/0x90 [ 933.753942] binder: 3419:3429 transaction failed 29189/-3, size 0-0 line 3035 [ 933.764391] do_group_exit+0x135/0x370 [ 933.775354] get_signal+0x399/0x1d50 [ 933.780443] binder: send failed reply for transaction 2050 to 3419:3421 [ 933.789527] binder: undelivered TRANSACTION_COMPLETE [ 933.801097] do_signal+0x87/0x1940 [ 933.809850] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.818719] ? kasan_check_read+0x11/0x20 [ 933.831237] ? _copy_to_user+0xc9/0x120 [ 933.836145] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.848394] ? setup_sigcontext+0x7d0/0x7d0 [ 933.856551] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.858721] kobject: 'kvm' (00000000e4af41d9): kobject_uevent_env [ 933.867312] ? exit_to_usermode_loop+0x43/0x2c0 [ 933.883584] kobject: 'kvm' (00000000e4af41d9): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 933.897645] ? do_syscall_64+0x52d/0x610 [ 933.918178] ? exit_to_usermode_loop+0x43/0x2c0 [ 933.931989] kobject: 'kvm' (00000000e4af41d9): kobject_uevent_env [ 933.939718] ? lockdep_hardirqs_on+0x415/0x5d0 [ 933.951810] ? trace_hardirqs_on+0x67/0x230 [ 933.953344] kobject: 'kvm' (00000000e4af41d9): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 933.964935] exit_to_usermode_loop+0x244/0x2c0 [ 933.977646] do_syscall_64+0x52d/0x610 [ 933.989721] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 934.004568] RIP: 0033:0x457f29 [ 934.013987] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 934.060879] RSP: 002b:00007f9f3844fcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 934.069418] RAX: fffffffffffffe00 RBX: 000000000073bf08 RCX: 0000000000457f29 [ 934.077391] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000073bf08 [ 934.085674] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 934.093681] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000073bf0c [ 934.103175] R13: 00007ffeac56e25f R14: 00007f9f384509c0 R15: 000000000073bf0c [ 934.111253] [ 934.111253] Showing all locks held in the system: [ 934.119993] kobject: 'rx-0' (00000000ed9b18cf): kobject_cleanup, parent 00000000196f8243 [ 934.128906] kobject: 'rx-0' (00000000ed9b18cf): auto cleanup 'remove' event [ 934.136949] 2 locks held by kworker/0:1/12: [ 934.141800] 2 locks held by kworker/u4:1/21: [ 934.149255] kobject: 'rx-0' (00000000ed9b18cf): kobject_uevent_env [ 934.156538] #0: 0000000043c353c3 (&rq->lock){-.-.}, at: __schedule+0x1fc/0x1cc0 [ 934.165831] kobject: 'rx-0' (00000000ed9b18cf): kobject_uevent_env: uevent_suppress caused the event to drop! [ 934.180230] #1: 000000008025e704 (rcu_read_lock){....}, at: update_curr+0x2ce/0x8a0 [ 934.189192] kobject: 'rx-0' (00000000ed9b18cf): auto cleanup kobject_del [ 934.197540] 4 locks held by kworker/u4:2/66: [ 934.204013] 1 lock held by khungtaskd/1040: [ 934.210786] kobject: 'rx-0' (00000000ed9b18cf): calling ktype release [ 934.219970] kobject: 'loop4' (0000000083362e4d): kobject_uevent_env [ 934.221190] #0: 000000008025e704 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e [ 934.236533] kobject: 'rx-0': free name [ 934.237390] kobject: 'loop4' (0000000083362e4d): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 934.246354] audit: type=1804 audit(1551847758.771:383): pid=3425 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir620796598/syzkaller.KZiDP9/680/file0" dev="sda1" ino=17609 res=1 [ 934.278480] kobject: 'tx-0' (000000002acda88c): kobject_cleanup, parent 00000000196f8243 [ 934.292588] 2 locks held by rs:main Q:Reg/7557: [ 934.305707] 1 lock held by rsyslogd/7559: [ 934.322467] #0: 00000000fd1f21b4 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 934.324069] kobject: 'tx-0' (000000002acda88c): auto cleanup 'remove' event [ 934.331847] 2 locks held by getty/7650: [ 934.351484] kobject: 'tx-0' (000000002acda88c): kobject_uevent_env [ 934.364725] #0: 000000003d53cdde (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.371817] kobject: 'tx-0' (000000002acda88c): kobject_uevent_env: uevent_suppress caused the event to drop! [ 934.380086] audit: type=1800 audit(1551847758.781:384): pid=3425 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17609 res=0 [ 934.391869] kobject: 'tx-0' (000000002acda88c): auto cleanup kobject_del [ 934.410539] #1: 000000000d6996c3 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.442564] kobject: 'tx-0' (000000002acda88c): calling ktype release [ 934.450733] kobject: 'tx-0': free name [ 934.455221] 2 locks held by getty/7651: [ 934.461730] #0: 000000006e28c5fc (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.472508] kobject: 'queues' (00000000196f8243): kobject_cleanup, parent (null) [ 934.477792] #1: 000000006300d016 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.492594] kobject: 'queues' (00000000196f8243): calling ktype release [ 934.494304] 2 locks held by getty/7652: [ 934.499395] kobject: 'queues' (00000000196f8243): kset_release [ 934.499412] kobject: 'queues': free name [ 934.500012] kobject: 'ip6gre0' (0000000013b90761): kobject_uevent_env [ 934.509176] #0: 00000000743418e0 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.522489] kobject: 'ip6gre0' (0000000013b90761): kobject_uevent_env: uevent_suppress caused the event to drop! [ 934.578454] #1: 00000000a4af81fc (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.607469] 2 locks held by getty/7653: [ 934.622994] #0: 0000000073b446ea (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.654471] #1: 00000000c54dd009 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.686009] 2 locks held by getty/7654: [ 934.710176] #0: 0000000047a78f18 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.744662] #1: 00000000bd778c12 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.776674] 2 locks held by getty/7655: [ 934.780978] #0: 00000000e05fd427 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.808839] #1: 000000007c75e6ba (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.837227] 2 locks held by getty/7656: [ 934.850148] #0: 00000000dd84b258 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 934.874582] #1: 0000000089c3f2e3 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 [ 934.891432] 2 locks held by kworker/u4:5/7848: [ 934.900555] #0: 0000000061fe6c95 ((wq_completion)"events_unbound"){+.+.}, at: process_one_work+0x87e/0x1790 [ 934.928017] #1: 000000008f76043a (connector_reaper_work){+.+.}, at: process_one_work+0x8b4/0x1790 [ 934.959528] 2 locks held by kworker/u4:6/26280: [ 934.971139] #0: 0000000061fe6c95 ((wq_completion)"events_unbound"){+.+.}, at: process_one_work+0x87e/0x1790 [ 934.999713] #1: 000000006ead8b4d ((reaper_work).work){+.+.}, at: process_one_work+0x8b4/0x1790 [ 935.020000] 2 locks held by syz-executor.1/27559: [ 935.025844] #0: 0000000081f30905 (&sb->s_type->i_mutex_key#10){+.+.}, at: __sock_release+0x89/0x2b0 [ 935.039093] #1: 00000000ea4c4304 (sk_lock-AF_INET6){+.+.}, at: tls_sk_proto_close+0xd6/0x7a0 [ 935.049165] 3 locks held by kworker/1:1/2381: [ 935.054483] #0: 0000000085cdf321 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0x87e/0x1790 [ 935.066336] #1: 0000000086fd32ce ((work_completion)(&(&ifa->dad_work)->work)){+.+.}, at: process_one_work+0x8b4/0x1790 [ 935.079625] #2: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.087989] 1 lock held by syz-executor.3/3371: [ 935.093306] #0: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.103937] 1 lock held by syz-executor.1/3416: [ 935.108995] #0: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.116723] 1 lock held by syz-executor.1/3430: [ 935.121847] #0: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.129630] 1 lock held by syz-executor.5/3426: [ 935.134725] #0: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.142814] 1 lock held by syz-executor.5/3427: [ 935.147828] #0: 000000009dacbee4 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 [ 935.155940] [ 935.157910] ============================================= [ 935.157910] [ 935.165444] NMI backtrace for cpu 1 [ 935.169235] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0+ #7 [ 935.175640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 935.185040] Call Trace: [ 935.187639] dump_stack+0x172/0x1f0 [ 935.191284] nmi_cpu_backtrace.cold+0x63/0xa4 [ 935.195786] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 935.200723] nmi_trigger_cpumask_backtrace+0x1be/0x236 [ 935.206006] arch_trigger_cpumask_backtrace+0x14/0x20 [ 935.211195] watchdog+0x9df/0xee0 [ 935.214681] kthread+0x357/0x430 [ 935.218052] ? reset_hung_task_detector+0x30/0x30 [ 935.222896] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 935.228440] ret_from_fork+0x3a/0x50 [ 935.232306] Sending NMI from CPU 1 to CPUs 0: [ 935.237226] NMI backtrace for cpu 0 [ 935.237233] CPU: 0 PID: 27202 Comm: kworker/u4:7 Not tainted 5.0.0+ #7 [ 935.237240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 935.237245] Workqueue: bat_events batadv_nc_worker [ 935.237252] RIP: 0010:trace_hardirqs_on+0x59/0x230 [ 935.237265] Code: 65 8b 1d ba 9e 8c 7e 81 e3 00 00 10 00 31 ff 89 de e8 db 96 fa ff 85 db 74 2d e8 52 95 fa ff 65 c7 05 37 2d 8d 7e 00 00 00 00 42 95 fa ff 48 8b 7d 08 e8 a9 0a e2 ff 48 83 c4 08 5b 41 5c 41 [ 935.237270] RSP: 0018:ffff888091227be0 EFLAGS: 00000093 [ 935.237278] RAX: ffff8880a86c62c0 RBX: 0000000000000000 RCX: ffffffff81754f25 [ 935.237284] RDX: 0000000000000000 RSI: ffffffff81754f2e RDI: 0000000000000005 [ 935.237290] RBP: ffff888091227c10 R08: ffff8880a86c62c0 R09: ffffed100951f3c7 [ 935.237296] R10: ffffed100951f3c6 R11: ffff88804a8f9e33 R12: ffffffff86ea5d67 [ 935.237302] R13: ffffffff8706b6e1 R14: ffffffff8144bf4a R15: 0000000000000012 [ 935.237308] FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 935.237313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 935.237319] CR2: 00007fbfe95e5db8 CR3: 0000000096f78000 CR4: 00000000001426f0 [ 935.237325] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 935.237331] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 935.237335] Call Trace: [ 935.237339] ? batadv_nc_purge_paths+0x267/0x370 [ 935.237344] ? batadv_nc_purge_orig_nc_nodes+0x260/0x260 [ 935.237349] __local_bh_enable_ip+0x15a/0x270 [ 935.237353] _raw_spin_unlock_bh+0x31/0x40 [ 935.237357] batadv_nc_purge_paths+0x267/0x370 [ 935.237362] batadv_nc_worker+0x2cf/0x760 [ 935.237366] process_one_work+0x98e/0x1790 [ 935.237370] ? pwq_dec_nr_in_flight+0x320/0x320 [ 935.237374] ? lock_acquire+0x16f/0x3f0 [ 935.237379] worker_thread+0x98/0xe40 [ 935.237383] ? trace_hardirqs_on+0x67/0x230 [ 935.237387] kthread+0x357/0x430 [ 935.237391] ? process_one_work+0x1790/0x1790 [ 935.237396] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 935.237400] ret_from_fork+0x3a/0x50 [ 935.240140] Kernel panic - not syncing: hung_task: blocked tasks [ 935.437494] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0+ #7 [ 935.443878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 935.453216] Call Trace: [ 935.455795] dump_stack+0x172/0x1f0 [ 935.459414] panic+0x2cb/0x65c [ 935.462592] ? __warn_printk+0xf3/0xf3 [ 935.466467] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 935.471381] ? ___preempt_schedule+0x16/0x18 [ 935.475776] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 935.481210] ? nmi_trigger_cpumask_backtrace+0x1fa/0x236 [ 935.486645] ? nmi_trigger_cpumask_backtrace+0x204/0x236 [ 935.492086] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 935.497523] watchdog+0x9f0/0xee0 [ 935.500986] kthread+0x357/0x430 [ 935.504351] ? reset_hung_task_detector+0x30/0x30 [ 935.509199] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 935.514725] ret_from_fork+0x3a/0x50 [ 935.519304] Kernel Offset: disabled [ 935.522934] Rebooting in 86400 seconds..